These images build on top of the official postgres:<version>-alpine base and
create a reusable dbo role that can run application migrations without being a
superuser. They provide a consistent foundation for local development,
continuous integration, and other automation that should never run as the
cluster owner.
Heads-up: This project is a community-maintained wrapper around the upstream PostgreSQL images. It is not affiliated with or endorsed by the PostgreSQL Global Development Group. If you are new to PostgreSQL, start with the official documentation—it's excellent.
Per-leg CI status, refreshed automatically after every workflow run. Click any cell to open the workflow's run history on GitHub Actions.
| Variant | PG 13 | PG 14 | PG 15 | PG 16 | PG 17 | PG 18 |
|---|---|---|---|---|---|---|
latest |
 |
 |
 |
 |
 |
 |
dbo |
 |
 |
 |
 |
 |
 |
pgtap |
 |
 |
 |
 |
 |
 |
pgcrypto |
 |
 |
 |
 |
 |
 |
pgvector |
 |
 |
 |
 |
 |
 |
All variants create the same non-superuser dbo role with the default password
mysecretpassword. Change this with the standard POSTGRES_PASSWORD
environment variable when starting the container.
| Variant | Includes |
|---|---|
latest |
dbo role plus the pgTAP, pgcrypto, and pgvector (as the vector extension) extensions, each in their dedicated schemas. |
dbo |
Baseline PostgreSQL image with only the dbo role configured. |
pgtap |
dbo role plus the pre-installed pgTAP extension in the pgtap schema. |
pgcrypto |
dbo role plus the pre-installed pgcrypto extension in the pgcrypto schema. |
pgvector |
dbo role plus the pre-installed pgvector extension (vector) in the pgvector schema. |
All images revoke default access from the public schema and grant
dbo the ability to connect to the default postgres database. The latest,
pgtap, pgcrypto, and pgvector variants temporarily elevate dbo during
initialization to install their respective extensions before dropping
superuser privileges again.
Each variant is published for PostgreSQL major versions 13 through 18. Tags
follow the pattern <variant>-pg<version>. Every published tag is a
multi-architecture manifest covering linux/amd64 and linux/arm64.
Note: Tags reflect the most recent successful CI build for each variant. During the few minutes after a workflow change merges, the published manifests may briefly lag the source until CI rebuilds.
| Variant | Default tag | Additional tags |
|---|---|---|
| latest | latest → PostgreSQL 18 |
latest-pg13, latest-pg14, latest-pg15, latest-pg16, latest-pg17, latest-pg18 |
| dbo | dbo → PostgreSQL 18 |
dbo-pg13, dbo-pg14, dbo-pg15, dbo-pg16, dbo-pg17, dbo-pg18 |
| pgtap | pgtap → PostgreSQL 18 |
pgtap-pg13, pgtap-pg14, pgtap-pg15, pgtap-pg16, pgtap-pg17, pgtap-pg18 |
| pgcrypto | pgcrypto → PostgreSQL 18 |
pgcrypto-pg13, pgcrypto-pg14, pgcrypto-pg15, pgcrypto-pg16, pgcrypto-pg17, pgcrypto-pg18 |
| pgvector | pgvector → PostgreSQL 18 |
pgvector-pg13, pgvector-pg14, pgvector-pg15, pgvector-pg16, pgvector-pg17, pgvector-pg18 |
Builds on the main branch publish these tags to Docker Hub. Pull requests run
full builds for validation but skip the registry login and push steps, so no tags
are published from PR validation jobs.
docker run --name some-name -e POSTGRES_PASSWORD=mysecretpassword sirsplat/postgresql -d postgresThis starts a container named some-name that exposes PostgreSQL on port 5432.
Connect with the pre-created dbo role:
docker exec -it some-name psql -U dbo -h localhost -p 5432 -d postgres- Use a different password: set
POSTGRES_PASSWORDto the desired value. - Create a different database: provide
POSTGRES_DB=my_db. - Persist data: mount a volume at
/var/lib/postgresql/dataor use Docker named volumes so that data outlives the container lifecycle. - Enable extensions: connect as
dbo(or another privileged role) and run standardCREATE EXTENSIONcommands. Thelatestvariant includespgtap,pgcrypto, andpgvector(as thevectorextension) all pre-installed in dedicated schemas; the single-extension variants (pgtap,pgcrypto,pgvector) install just their named extension.