# Are Bitnami backups secure?
**URL:** https://meta.discourse.org/t/are-bitnami-backups-secure/125348
**Category:** Support
**Tags:** unsupported-install
**Created:** [August 9, 2019, 7:09pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348 "2019-08-09T19:09:49Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@MatthewCroughan](https://meta.discourse.org/u/MatthewCroughan)
#### Post date: [August 9, 2019, 7:09pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/1 "2019-08-09T19:09:49Z")
Hey, I was wanting to set up a deployable thing for my makerspace, and to do this I’m using the Bitnami docker-compose setup.
[https://github.com/bitnami/bitnami-docker-discourse](https://github.com/bitnami/bitnami-docker-discourse)
Can I place the database backup in the git repo, or in the releases tab such that anyone from my makerspace can simply run docker-compose, then apply the backup in the web interface to get back to a working state?
Or are there important details inside the backup that would allow full admin access to things, equivalent to giving someone full filesystem access to your machine?
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [August 9, 2019, 7:19pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/2 "2019-08-09T19:19:40Z")
First, we do not support the bitnami installs. You’ll be on your own in terms of support if you go that way rather than following our [official install instructions](https://github.com/discourse/discourse/blob/master/docs/INSTALL-cloud.md).
Second, yeah, you don’t want to put a Discourse backup somewhere public. All information on the site would then be available to someone who wants to access it. This includes PMs, topics in secure categories, as well as personal information like IP addresses, emails and hashed passwords.
---
### Author:  [@MatthewCroughan](https://meta.discourse.org/u/MatthewCroughan)
#### Post date: [August 9, 2019, 7:31pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/3 "2019-08-09T19:31:49Z")
I understand that the Bitnami docker stuff would be unsupported, but there is no native/official option for me, as anything more complex than “`docker-compose up -d` then open the Web UI and restore the backup” is too much for the members that would be taking over should anything happen to the maintainer.
Thank you for confirming that the database includes absolutely everything in plaintext except for passwords 🙂
---
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [August 9, 2019, 7:36pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/4 "2019-08-09T19:36:58Z")
> [@MatthewCroughan](#):
>
> as anything more complex than " `docker-compose up -d` then open the Web UI and restore the backup" is too much for the members that would be taking over should anything happen to the maintainer.
But at least they could come here for support if you followed the [official install](https://meta.discourse.org/t/142537?silent=true)?
---
### Author:  [@MatthewCroughan](https://meta.discourse.org/u/MatthewCroughan)
#### Post date: [August 9, 2019, 8:08pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/5 "2019-08-09T20:08:28Z")
What would you ever need support for `docker-compose up -d` for? And furthermore, why would that fail? For that to happen, some element of the underlying system such as `apt` and their repos would have to fail, right? It is nothing more than a system built around the packages and software discourse provide. It is subordinate to discourse, not the other way around.
What is bitnami doing in their compose that is any different than what `launcher` does? It’s simply doing what you would already do, automating the steps you have to follow with `launcher` in a more docker-native way sure.
I’m not clairvoyant and wouldn’t like to predict the future, but all docker-compose is doing is acting as a much more reliable bash script. I could do all of this with a bash script, it would be 100 lines long and filled with docker commands, and I’m certain you’d still support me and my very silly, unmaintainable and pointless bash script. What’s the issue here? Why does slapping “docker-compose” into the sentence put into the “not supported” category?
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [August 9, 2019, 8:15pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/6 "2019-08-09T20:15:19Z")
Bitnami puts you in #unsupported-install, the only support offered via the community is for the [standard install](https://meta.discourse.org/t/142537?silent=true).
---
### Author:  [@MatthewCroughan](https://meta.discourse.org/u/MatthewCroughan)
#### Post date: [August 9, 2019, 8:15pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/7 "2019-08-09T20:15:58Z")
Would you guys help me if I wanted to make a really long bash script that does all the launcher commands, etc?
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [August 9, 2019, 8:16pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/8 "2019-08-09T20:16:19Z")
No, because the only supported install is the [standard install](https://meta.discourse.org/t/142537?silent=true).
If you choose to do anything outside of that you assume all the risk and added technical complexity.
---
### Author:  [@MatthewCroughan](https://meta.discourse.org/u/MatthewCroughan)
#### Post date: [August 9, 2019, 8:18pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/9 "2019-08-09T20:18:14Z")
Right, I understand that logic then. I thought it was more of a “Go away” sort of thing, I didn’t realize there was separation between Official and Non-Official support, as usually I just go to IRCs for this sort of question.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 9, 2019, 8:19pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/10 "2019-08-09T20:19:47Z")
> [@MatthewCroughan](#):
>
> What would you ever need support for `docker-compose up -d` for?
If you didn’t need support for it, you’d not have started this topic.
> [@MatthewCroughan](#):
>
> What is bitnami doing in their compose that is any different than what `launcher` does?
We don’t know and neither do you.
> [@MatthewCroughan](#):
>
> I’m not clairvoyant and wouldn’t like to predict the future, but all docker-compose is doing is acting as a much more reliable bash script.
You’re all set then!
`./discourse-setup` is much easier to type and easier to understand than `docker-compose up -d`. It handles lots of things and works for lots of people who have never seen a command line. And your members will have a lot better chance of getting help if you install the way hundreds of other people have.
If you want to use Bitnami, head on over to the Bitnami forums for support.
---
### Author:  [@MatthewCroughan](https://meta.discourse.org/u/MatthewCroughan)
#### Post date: [August 9, 2019, 8:23pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/11 "2019-08-09T20:23:54Z")
If that’s the project ethos, etc, sure. I just like it when I can go to an IRC and get sensible, collaborative, non-robotic open source answers, which is the only reason I’m putting up any sort of front here. The key-word is ‘collaborative’, rather than “That project’s so different” when it really isn’t too different.
I’ve been in the Docker IRC for lots of unrelated things, docker doesn’t “support” Discourse, but they’d sure help me set it up, as they have with Nextcloud and a few other projects. Maybe I just ended up in the wrong category, sorry.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [August 9, 2019, 8:40pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/12 "2019-08-09T20:40:07Z")
> [@MatthewCroughan](#):
>
> I just like it when I can go to an IRC and get sensible, collaborative, non-robotic open source answers, which is the only reason I’m putting up any sort of front here. The key-word is ‘collaborative’, rather than “That project’s so different” when it really isn’t too different.
You can absolutely get those answers here, but if we had to support N different ways of deploying our software then our ability to support those ways (all but one are done by another entity after all) our support complexity would skyrocket.
I love this succinct response:
> [@pfaffman](#):
>
> > What is bitnami doing in their compose that is any different than what `launcher` does?
>
> We don’t know and neither do you.
This is the crux: We have absolutely NO idea what they are doing and how what they’ve done may subtly break / prevent upgrades / cause odd problems, nor do we know how to interact with their custom setup.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 9, 2019, 8:46pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/13 "2019-08-09T20:46:20Z")
We _promise_ that if you follow the prescribed instructions they’ll work. We really, really, really, want it to work, especially if there’s some chance that you’re going to leave this for someone else to deal with later. If you search for Bitnami here, you’ll find dozens of people who have tried and given up.
But maybe someone who made Bitnami work and is really happy with it will chime in soon.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 9, 2019, 8:55pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/14 "2019-08-09T20:55:03Z")
But if this is all you want to know. . .
> [@MatthewCroughan](#):
>
> Or are there important details inside the backup that would allow full admin access to things, equivalent to giving someone full filesystem access to your machine?
Anyone who has rights to restore the whole database could ostensibly change something in it to, say, give them admin access.
---
### Author:  [@MatthewCroughan](https://meta.discourse.org/u/MatthewCroughan)
#### Post date: [August 9, 2019, 10:19pm UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/15 "2019-08-09T22:19:02Z")
Hah! Well to introduce someone to Docker now, I’m about to show someone Who’s 38~, used Unix for ages and is completely unaware of it. I’ll tell you how it goes, the test scenario is this.
[https://github.com/DoESLiverpool/robochallenge](https://github.com/DoESLiverpool/robochallenge)
We will simply `docker-compose up -d` and then import the database from the backup, we’ll see how it goes 😃
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 10, 2019, 4:33am UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/16 "2019-08-10T04:33:17Z")
> [@MatthewCroughan](#):
>
> Or are there important details inside the backup that would allow full admin access to things, equivalent to giving someone full filesystem access to your machine?
The actual Discourse _database_ backup has a bunch of stuff in it, including hashed passwords, the content of all posts, all the user information (basically just email address in practice). It would not be great if this landed in the hands of an evildoer who plans to do you harm though it depends how much of that is public posts versus personal messages or secure categories … etcetera.
However, obtaining the Discourse database _does not_ grant anyone SSH access to the server that Discourse is running on, in any way whatsoever.
That’s the best I can do to answer your first post, though I’m kinda unclear what your question actually _is_ at this point.
---
### Author:  [@MatthewCroughan](https://meta.discourse.org/u/MatthewCroughan)
#### Post date: [August 10, 2019, 4:47am UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/17 "2019-08-10T04:47:39Z")
Well I know it wouldn’t give them shell access, clearly. I was just wondering what the nature of the content included was, and whether that was all parsed later by the database once it was unlocked, like how Bitwarden works for example. I didn’t want to assume it was insecure and do unnecessary encryption/security on top, so asked here.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [September 9, 2019, 4:47am UTC](https://meta.discourse.org/t/are-bitnami-backups-secure/125348/18 "2019-09-09T04:47:43Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.