Improve stability: expand smoke tests and harden optional deps

A75G · A75G · commit 3a626c803eda · 2026-03-07T15:39:11.000+03:00
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
@@ -28,130 +28,8 @@ jobs:
       - name: Run Integration Matrix
         shell: bash
         run: |
-          set -euo pipefail
-
-          IMAGE="a75g/docker-db-backup:ci"
-          NET="dbbackup-ci-net"
-          TMP_ROOT="${RUNNER_TEMP}/dbbackup-ci"
-          PG_BACKUP_DIR="${TMP_ROOT}/pg"
-          MYSQL_BACKUP_DIR="${TMP_ROOT}/mysql"
-          REDIS_BACKUP_DIR="${TMP_ROOT}/redis"
-
-          mkdir -p "${PG_BACKUP_DIR}" "${MYSQL_BACKUP_DIR}" "${REDIS_BACKUP_DIR}"
-
-          cleanup() {
-            docker rm -f dbbackup-pg pg18-ci dbbackup-mysql mysql8-ci dbbackup-redis redis7-ci >/dev/null 2>&1 || true
-            docker network rm "${NET}" >/dev/null 2>&1 || true
-          }
-          trap cleanup EXIT
-          cleanup
-          docker network create "${NET}" >/dev/null
-
-          echo "=== PostgreSQL 18 backup + restore smoke ==="
-          docker run -d --name pg18-ci --network "${NET}" \
-            -e POSTGRES_PASSWORD=postgres \
-            -e POSTGRES_DB=testdb \
-            postgres:18 >/dev/null
-
-          for i in $(seq 1 60); do
-            if docker exec pg18-ci pg_isready -U postgres >/dev/null 2>&1; then
-              break
-            fi
-            sleep 2
-          done
-
-          docker exec pg18-ci psql -U postgres -d testdb -c "CREATE TABLE IF NOT EXISTS ci_items(id int primary key, val text);" >/dev/null
-          docker exec pg18-ci psql -U postgres -d testdb -c "TRUNCATE ci_items;" >/dev/null
-          docker exec pg18-ci psql -U postgres -d testdb -c "INSERT INTO ci_items VALUES (1,'one'),(2,'two');" >/dev/null
-
-          docker run -d --name dbbackup-pg --network "${NET}" \
-            -v "${PG_BACKUP_DIR}:/backup" \
-            -e MODE=MANUAL \
-            -e CONTAINER_ENABLE_SCHEDULING=FALSE \
-            -e CONTAINER_ENABLE_MONITORING=FALSE \
-            -e MANUAL_RUN_FOREVER=TRUE \
-            -e DB01_TYPE=pgsql \
-            -e DB01_NAME=testdb \
-            -e DB01_HOST=pg18-ci \
-            -e DB01_USER=postgres \
-            -e DB01_PASS=postgres \
-            -e DB01_PORT=5432 \
-            -e DB01_BACKUP_LOCATION=FILESYSTEM \
-            "${IMAGE}" >/dev/null
-
-          sleep 10
-          docker exec dbbackup-pg backup-now >/dev/null
-
-          PG_FILE="$(docker exec dbbackup-pg sh -lc 'ls -1 /backup/pgsql_testdb_pg18-ci_*.sql.zst | head -n1 | xargs -n1 basename')"
-          test -n "${PG_FILE}"
-
-          docker exec pg18-ci psql -U postgres -d postgres -c "DROP DATABASE IF EXISTS restoredb;" >/dev/null
-          docker exec pg18-ci psql -U postgres -d postgres -c "CREATE DATABASE restoredb;" >/dev/null
-          docker exec dbbackup-pg restore "/backup/${PG_FILE}" pgsql pg18-ci restoredb postgres postgres 5432 >/dev/null
-          PG_COUNT="$(docker exec pg18-ci psql -U postgres -d restoredb -tAc "SELECT COUNT(*) FROM ci_items;")"
-          test "${PG_COUNT}" = "2"
-
-          echo "=== MySQL 8 backup + restore smoke ==="
-          docker run -d --name mysql8-ci --network "${NET}" \
-            -e MYSQL_ROOT_PASSWORD=rootpass \
-            -e MYSQL_DATABASE=appdb \
-            mysql:8 >/dev/null
-
-          for i in $(seq 1 90); do
-            if docker exec mysql8-ci sh -lc 'mysqladmin ping -h 127.0.0.1 -uroot -prootpass --silent >/dev/null 2>&1'; then
-              break
-            fi
-            sleep 2
-          done
-
-          docker exec mysql8-ci mysql -uroot -prootpass -e "CREATE DATABASE IF NOT EXISTS appdb; USE appdb; CREATE TABLE IF NOT EXISTS ci_items(id INT PRIMARY KEY, val VARCHAR(20)); TRUNCATE ci_items; INSERT INTO ci_items VALUES (1,'one'),(2,'two');" >/dev/null
-
-          docker run -d --name dbbackup-mysql --network "${NET}" \
-            -v "${MYSQL_BACKUP_DIR}:/backup" \
-            -e MODE=MANUAL \
-            -e CONTAINER_ENABLE_SCHEDULING=FALSE \
-            -e CONTAINER_ENABLE_MONITORING=FALSE \
-            -e MANUAL_RUN_FOREVER=TRUE \
-            -e DB01_TYPE=mysql \
-            -e DB01_NAME=appdb \
-            -e DB01_HOST=mysql8-ci \
-            -e DB01_USER=root \
-            -e DB01_PASS=rootpass \
-            -e DB01_PORT=3306 \
-            -e DB01_BACKUP_LOCATION=FILESYSTEM \
-            "${IMAGE}" >/dev/null
-
-          sleep 10
-          docker exec dbbackup-mysql backup-now >/dev/null
-
-          MYSQL_FILE="$(docker exec dbbackup-mysql sh -lc 'ls -1 /backup/mariadb_appdb_mysql8-ci_*.sql.zst | head -n1 | xargs -n1 basename')"
-          test -n "${MYSQL_FILE}"
-
-          docker exec mysql8-ci mysql -uroot -prootpass -e "DROP DATABASE IF EXISTS restoredb; CREATE DATABASE restoredb;" >/dev/null
-          docker exec dbbackup-mysql restore "/backup/${MYSQL_FILE}" mysql mysql8-ci restoredb root rootpass 3306 false >/dev/null
-          MYSQL_COUNT="$(docker exec mysql8-ci mysql -N -uroot -prootpass -e "SELECT COUNT(*) FROM restoredb.ci_items;")"
-          test "${MYSQL_COUNT}" = "2"
-
-          echo "=== Redis 7 backup smoke ==="
-          docker run -d --name redis7-ci --network "${NET}" redis:7 >/dev/null
-          sleep 5
-          docker exec redis7-ci redis-cli SET ci_key ci_value >/dev/null
-
-          docker run -d --name dbbackup-redis --network "${NET}" \
-            -v "${REDIS_BACKUP_DIR}:/backup" \
-            -e MODE=MANUAL \
-            -e CONTAINER_ENABLE_SCHEDULING=FALSE \
-            -e CONTAINER_ENABLE_MONITORING=FALSE \
-            -e MANUAL_RUN_FOREVER=TRUE \
-            -e DB01_TYPE=redis \
-            -e DB01_NAME=ALL \
-            -e DB01_HOST=redis7-ci \
-            -e DB01_PORT=6379 \
-            -e DB01_BACKUP_LOCATION=FILESYSTEM \
-            "${IMAGE}" >/dev/null
-
-          sleep 10
-          docker exec dbbackup-redis backup-now >/dev/null
-          docker exec dbbackup-redis sh -lc 'ls -1 /backup/redis_all_redis7-ci_*.rdb.zst >/dev/null'
-
-          echo "Integration tests passed."
+          chmod +x scripts/smoke-test.sh
+          IMAGE="a75g/docker-db-backup:ci" \
+          NET="dbbackup-ci-net" \
+          TMP_ROOT="${RUNNER_TEMP}/dbbackup-ci" \
+          scripts/smoke-test.sh
diff --git a/Dockerfile b/Dockerfile
@@ -3,6 +3,7 @@ ARG DISTRO_VARIANT=3.21-7.10.28
 ARG ENABLE_INFLUX1_CLIENT=false
 ARG ENABLE_MYSQL_SOURCE_CLIENT=false
 ARG ENABLE_BLOBXFER=false
+ARG ENABLE_MSSQL_CLIENT=false
 
 FROM docker.io/tiredofit/${DISTRO}:${DISTRO_VARIANT} AS compat
 
@@ -12,6 +13,7 @@ LABEL maintainer="Dave Conroy (github.com/tiredofit)"
 ARG ENABLE_INFLUX1_CLIENT
 ARG ENABLE_MYSQL_SOURCE_CLIENT
 ARG ENABLE_BLOBXFER
+ARG ENABLE_MSSQL_CLIENT
 
 RUN apk add --no-cache bash ca-certificates curl
 
@@ -49,7 +51,6 @@ RUN source /assets/functions/00-container && \
     addgroup -S -g 10000 dbbackup && \
     adduser -S -D -H -u 10000 -G dbbackup -g "Tired of I.T! DB Backup" dbbackup && \
     mkdir -p /usr/src /tmp/.container /backup /logs /tmp/backups && \
-    \
     package update && \
     package upgrade && \
     echo '@edge_main https://dl-cdn.alpinelinux.org/alpine/edge/main' >> /etc/apk/repositories && \
@@ -71,7 +72,6 @@ RUN source /assets/functions/00-container && \
                     py3-pip \
                     xz-dev \
                     && \
-    \
     package install .db-backup-run-deps \
                     bzip2 \
                     coreutils \
@@ -110,38 +110,36 @@ RUN source /assets/functions/00-container && \
     apk add --no-cache --upgrade \
             --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community \
             mongodb-tools redis && \
-    apk add --no-cache postgresql18-client --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main && \
-    \
+    apk add --no-cache postgresql18-client --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main
+
+RUN source /assets/functions/00-container && \
+    set -ex && \
     case "$(uname -m)" in \
-	    "x86_64" ) mssql=true ; mssql_arch=amd64; influx2=true ; influx_arch=amd64; ;; \
-        "arm64" | "aarch64" ) mssql=false ; influx2=true ; influx_arch=arm64 ;; \
-        *) sleep 0.1 ;; \
-    esac; \
-    \
-    if [ "${mssql,,}" = "true" ] ; then \
+        "x86_64" ) mssql_arch=amd64; influx2=true ; influx_arch=amd64; ;; \
+        "arm64" | "aarch64" ) mssql_arch=arm64; influx2=true ; influx_arch=arm64 ;; \
+        *) mssql_arch=none; influx2=false ;; \
+    esac && \
+    if [ "${ENABLE_MSSQL_CLIENT,,}" = "true" ] && [ "${mssql_arch}" != "none" ]; then \
         curl -sSLO https://download.microsoft.com/download/7/6/d/76de322a-d860-4894-9945-f0cc5d6a45f8/msodbcsql18_${MSODBC_VERSION}_${mssql_arch}.apk ; \
         curl -sSLO https://download.microsoft.com/download/7/6/d/76de322a-d860-4894-9945-f0cc5d6a45f8/mssql-tools18_${MSSQL_VERSION}_${mssql_arch}.apk ; \
         echo y | apk add --allow-untrusted msodbcsql18_${MSODBC_VERSION}_${mssql_arch}.apk mssql-tools18_${MSSQL_VERSION}_${mssql_arch}.apk ; \
     else \
-        echo >&2 "Detected non x86_64 or ARM64 build variant, skipping MSSQL installation" ; \
-    fi; \
-    \
+        echo "Skipping optional MSSQL client installation" ; \
+    fi && \
     if [ "${influx2,,}" = "true" ] ; then \
         curl -sSL https://dl.influxdata.com/influxdb/releases/influxdb2-client-${INFLUX2_CLIENT_VERSION}-linux-${influx_arch}.tar.gz | tar xvfz - --strip=1 -C /usr/src/ ; \
         chmod +x /usr/src/influx ; \
         mv /usr/src/influx /usr/sbin/ ; \
     else \
-        echo >&2 "Unable to build Influx 2 on this system" ; \
-    fi ; \
-    \
+        echo "Skipping optional InfluxDB v2 client install on this architecture" ; \
+    fi && \
     if [ "${ENABLE_INFLUX1_CLIENT,,}" = "true" ] ; then \
         clone_git_repo https://github.com/influxdata/influxdb "${INFLUX1_CLIENT_VERSION}" && \
         go build -o /usr/sbin/influxd ./cmd/influxd && \
         strip /usr/sbin/influxd ; \
     else \
         echo "Skipping optional InfluxDB v1 client build" ; \
     fi && \
-    \
     if [ "${ENABLE_MYSQL_SOURCE_CLIENT,,}" = "true" ] ; then \
         clone_git_repo "${MYSQL_REPO_URL}" "${MYSQL_VERSION}" && \
         cmake \
@@ -153,30 +151,28 @@ RUN source /assets/functions/00-container && \
         make -j$(nproc) install ; \
     else \
         echo "Skipping optional MySQL source client build (using mariadb-client)" ; \
-    fi && \
-    \
+    fi
+
+RUN source /assets/functions/00-container && \
+    set -ex && \
+    # Keep awscli pinned for deterministic S3 CLI behavior across architectures.
     pip3 install --break-system-packages awscli==${AWS_CLI_VERSION} && \
     if [ "${ENABLE_BLOBXFER,,}" = "true" ] ; then \
         pip3 install --break-system-packages blobxfer ; \
     else \
         echo "Skipping optional blobxfer installation" ; \
     fi && \
-    \
     mkdir -p /usr/src/pbzip2 && \
     curl -sSL https://launchpad.net/pbzip2/1.1/1.1.13/+download/pbzip2-1.1.13.tar.gz | tar xvfz - --strip=1 -C /usr/src/pbzip2 && \
     cd /usr/src/pbzip2 && \
     make && \
     make install && \
-    \
-    # Fail the build immediately if any core backup client is unavailable.
     command -v pg_dump >/dev/null 2>&1 && \
     command -v psql >/dev/null 2>&1 && \
     command -v mysqldump >/dev/null 2>&1 && \
     command -v mongodump >/dev/null 2>&1 && \
     command -v redis-cli >/dev/null 2>&1 && \
     command -v sqlite3 >/dev/null 2>&1 && \
-    \
-    \
     package remove .db-backup-build-deps && \
     package cleanup && \
     rm -rf \
diff --git a/README.md b/README.md
@@ -125,6 +125,11 @@ Optional build arguments (to reduce image size and attack surface):
 - `--build-arg ENABLE_INFLUX1_CLIENT=false` (default)
 - `--build-arg ENABLE_MYSQL_SOURCE_CLIENT=false` (default, uses `mariadb-client`)
 - `--build-arg ENABLE_BLOBXFER=false` (default)
+- `--build-arg ENABLE_MSSQL_CLIENT=false` (default; enable only if MSSQL backups/restores are needed)
+
+Dependency policy notes:
+- `awscli` is pinned in the image build for deterministic S3/MinIO behavior across environments.
+- Optional clients are controlled with build args to reduce attack surface and CVE churn when unused.
 
 ### Prebuilt Images
 
@@ -827,6 +832,15 @@ Manual backups can be performed by entering the container and typing `backup-now
 
 - Recently there was a request to run the container with Kubernetes cron scheduling. This can be done by setting `MODE=MANUAL` and `MANUAL_RUN_FOREVER=FALSE` while disabling scheduler features from the upstream base image (`CONTAINER_ENABLE_SCHEDULING=FALSE`). This allows the container to start, execute backups, and then exit cleanly. An alternative way to run the script is `/etc/services.available/10-db-backup/run`.
 
+### Local Smoke Test
+
+Run the same end-to-end smoke suite used by CI:
+
+```bash
+chmod +x scripts/smoke-test.sh
+IMAGE=a75g/docker-db-backup:ci scripts/smoke-test.sh
+```
+
 ### Restoring Databases
 
 Entering the container and executing `restore` runs a menu-based script to restore backups. MariaDB, PostgreSQL, and MongoDB are supported.
diff --git a/install/assets/functions/10-db-backup b/install/assets/functions/10-db-backup
@@ -918,8 +918,12 @@ backup_redis() {
 
 backup_sqlite3() {
     prepare_dbbackup
-    db=$(basename "${backup_job_db_host}")
-    db="${db%.*}"
+    if [ -n "${backup_job_db_name}" ] && [ "${backup_job_db_name,,}" != "all" ]; then
+        db="${backup_job_db_name}"
+    else
+        db=$(basename "${backup_job_db_host}")
+        db="${db%.*}"
+    fi
     backup_job_filename=sqlite3_${db}_${now}.sqlite3
     backup_job_filename_base=sqlite3_${db}
     pre_dbbackup "${db}"
diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
