Lowkey Vault Docker does not support dynamic host ports

[Xor-el]

Describe the bug

I encountered a blocker while working on this issue. According to the .NET TestContainers best practices, it is recommended to avoid static host port bindings for containers. Instead, the guidelines suggest using randomly assigned host ports via _builder.WithPortBinding(ushort, true) and retrieving the mapped port using _container.GetMappedPublicPort(ushort).

However, it seems that Lowkey Vault Docker does not support the use of random host ports. Instead, it requires the host, container, and server ports to match, which conflicts with the best practices outlined by .NET TestContainers.

To reproduce

Steps to reproduce the behavior:

1. Clone this repo and build

2. run this docker command, note that the host port is different from the container port.
   docker run --rm --name lowkey -d -p 8550:8443 nagyesta/lowkey-vault:2.6.15

3. run the demo built in Step 1

Expected behavior

Dynamic host ports should be supported as it is not guaranteed that a port would always be available on the host.

Actual behavior

When I run the demo

A minimal project that can be used to reproduce the issue

LowKeyVaultDockerDemo

Environment

• OS: [e.g. Windows]
• Version: [e.g. 2.6.15]
• Java version [e.g. 17.0.13]

Additional context

Using a static port for the host might not always be possible as that port might be unavailable on the host.

[nagyesta]

Hi @Xor-el ,
thanks for reporting this! I have reclassified it as a feature request because it was a known limitation due to how the vault identification works. Nonetheless, I see value in solving this, because as you have mentioned, we cannot guarantee that the same port is always open.

The very hacky workaround which exists is to find a free port and configure Lowkey Vault to use that port.

I will take a look during the weekend and see how I can make this work in a convenient way with the random port assigned by Testcontainers.

Thank you again!

[Xor-el]

@nagyesta Thanks for looking into this. very much appreciated.

[nagyesta]

Hi @Xor-el ,
I think I have managed to solve this. Please try with 2.7.0 using the new relaxed port matching feature.

Please feel free to reach out on this ticket in case it is still not working!

[Xor-el]

Hello @nagyesta , thanks for the fix.
I can confirm that this works as expected.
one more thing, could you please update the multi-platform image (-ubi9-minimal) to v2.7.0?

[Xor-el]

so this seems to have broken vault aliases.
will post a demo to reproduce it soon.

[nagyesta]

Thanks @Xor-el! Sure, I will, just waiting for Renovate to raise the PR when the artifact becomes usable.

[Xor-el]

so this seems to have broken vault aliases. will post a demo to reproduce it soon.

so here is how to reproduce this

set any of the below as the env

LOWKEY_ARGS=--LOWKEY_VAULT_NAMES=demo --LOWKEY_VAULT_ALIASES="demo.localhost=demo.127.0.0.1 --LOWKEY_VAULT_RELAXED_PORTS=true

or

LOWKEY_ARGS=--LOWKEY_VAULT_NAMES=demo --LOWKEY_VAULT_ALIASES="demo.localhost=demo.127.0.0.1:8443 --LOWKEY_VAULT_RELAXED_PORTS=true

then run

docker run --rm --name lowkey -d -p 8550:8443 nagyesta/lowkey-vault:2.7.0

Lowkey Vault then crashes with an exception.

[nagyesta]

Thanks @Xor-el ! I am sorry to hear this! I will take a look tonight and see what is causing this.

[nagyesta]

Thanks @Xor-el! Sure, I will, just waiting for Renovate to raise the PR when the artifact becomes usable.

This is complete in the meantime.

[Xor-el]

@nagyesta here is a screenshot of the exception

[nagyesta]

I have found the root cause @Xor-el ! The Java URI parser implementation, which is required for the dynamic ports to work, is not able to find the "host" part of the https://demo.127.0.0.1:8443 URI. Probably because it should either contain an IP address or DNS name labels, but we cannot mix the two. As soon as I changed the alias to a valid name, it worked.

Based on this, I have only made it slightly nicer to produce a more informative log. Hopefully this will help the users find the issues in the input parameters:

Caused by: java.lang.IllegalArgumentException: URI couldn't be parsed: https://demo.127.0.0.1:8443
	at com.github.nagyesta.lowkeyvault.context.util.VaultUriUtil.vaultUri(VaultUriUtil.java:29)
	at com.github.nagyesta.lowkeyvault.context.util.VaultUriUtil.aliasUri(VaultUriUtil.java:44)
	at com.github.nagyesta.lowkeyvault.AppConfiguration.lambda$doAddVaultAliases$4(AppConfiguration.java:98)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183)
	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)

This small fix will be available in v2.7.1 when the release process completes.

[Xor-el]

Hello @nagyesta thanks for the explanation, well understood.
I think we can close this issue now.

[nagyesta]

Okay, thank you for your understanding!