[OracleContainer] Unable to execute statements which need system privileges

[tomdevroomen]

I just updated to testcontainers 1.16.2 with new OracleContainer setup.
Before I could use a initScript to create tablespaces, but now I'm not able to use system user anymore.

The system user has been disabled, but I need to create tablespaces, for which the test user doesn't have privileges.

I've tried to copy the initScript to the container with .withCopyFileToContainer(MountableFile.forClasspathResource("init.sql"), "container-entrypoint-startdb.d/"); but the script wasn't picked up when the container was started.

How should I proceed?

Thank you!

[kiview]

This approach should work, see also the "Initialization script" paragraph in the image docs:
https://hub.docker.com/r/gvenzl/oracle-xe

Can you please share a simple reproducer example, as per https://github.com/testcontainers/testcontainers-java-repro?

[tomdevroomen]

Thank you for your reply.
I worked around this with:
new OracleContainer("gvenzl/oracle-xe:slim") .withCopyFileToContainer(MountableFile.forClasspathResource("testcontainers/init.sql"), "/container-entrypoint-startdb.d/init.sql");

So, my initialization wasn't right.

In the script I execute I explicitly need to add ALTER SESSION SET CONTAINER=XEPDB1 to create my tablespaces.
And need to add TEST schema for tables I create within this init script.

Before 1.16.2 the container was much easier to use, imho.

I'll try to complete the sample asap.

[kiview]

This code looks fine. But do I understand it correctly that it works now?
In this case, we don't need an example.

What aspect exactly was easier to use with the old Oracle XE image? Asking so I can understand if this is something that Testcontainers should provide as an API or something that should be changed in the image (cc @gvenzl).

[tomdevroomen]

Yes, all is working now.

I'd like to provide feedback on the changes made in TestContainers and the Oracle-XE image:

From a testcontainers users view, I'm not allowed to use the SYSTEM user anymore, which makes it more difficult to create database objects, which need sys admin privileges.
I've seen in the code this is explicitly prohibited now (probably with good reasons?)

From a oracle-xe image users view, now the default user and schema is now "TEST".
Meaning tables I create need to be prefixed with "TEST" if I use the Initialization script.
Plus I need to add ALTER SESSION SET CONTAINER=XEPDB1; to put them in the right place.

Before 1.16.2 this all wasn't needed.

I'm also using Flyway, before 1.16.2 and the latest Oracle XE image, all this setup could be managed with a Flyway beforeMigrate script and now I need to have scripts on different levels, because of the limitations added in TestContainers and the addition of the default TEST user in the image.

So, it is more a combination of things, why I need to do some extra labour to connect all the dots and make it work.

[kiview]

Unfortunately, I can't really comment on the implementation details and best practices of the Oracle XE image we use (since this is provided by the community, @gvenzl in this case). So in this regard, we tend to rely on technology experts from the community that maintain Docker images. Testcontainers always needs to implicitly integrate against the used image and its constraints. Also, note that compared to the previously used default image by an anonymous maintainer, we are now using an image that has been adopted by wider parts of the community and considerably improves our abilities to continuously support it.

However, we can always improve the UX, either by providing higher-level APIs or implementing it upstream in the image. In this case, I personally can't assess what is the best way to use the image for your use case and what are the Oracle idiomatic ways of using tablespaces and initialization scripts (or if it could be solved by other means or by using a pluggable database?).

[gvenzl]

Hi all, I think this issue here is related to the one that @tomdevroomen also opened over at gvenzl/oci-oracle-xe#41.

From a oracle-xe image users view, now the default user and schema is now "TEST".
Meaning tables I create need to be prefixed with "TEST" if I use the Initialization script.
Plus I need to add ALTER SESSION SET CONTAINER=XEPDB1; to put them in the right place.

Before 1.16.2 this all wasn't needed.

@tomdevroomen, I'm afraid I don't have much knowledge about how things were before 1.16.2, so I apologize for my naivety here in advance. Obviously creating additional tablespaces or other database components is something to be expected on a regular basis, hence I want to make sure that we make this easy again. How do the steps now compare to the ones before? Why do tables need to be prefixed with "TEST" if you use the initialization scripts and how did you create that new tablespace (and others) previously?

[kiview]

@tomdevroomen Can you please provide a code example of how you did it with the older version?

Note that you can also construct the JDBC URL yourself and e.g. use SYSTEM user. Would this solve your problem?

[tomdevroomen]

Hi, thank you for this conversation and let's see if we can improve things, either on my side or the testcontainers/oci-oracle-xe side :-)

Before my script to have a basic setup for my db was:

CREATE TABLESPACE MY_TABLESPACE
    DATAFILE 'tablespace.dbf'
    SIZE 1m;

CREATE TABLE MY_TABLE
(
    ID NUMBER(19) NOT NULL PRIMARY KEY
);

CREATE ROLE MY_ROLE;

I was able to run this script through the TestContainers API:

OracleContainer db = new OracleContainer("gvenzl/oracle-xe:slim").withInitScript("tables_views.sql");

Now with the changes made in 1.16.2 and the introduction of the default test user on the image the script and code to have the same result are:

-- ADDED
ALTER SESSION SET CONTAINER=XEPDB1;

CREATE TABLESPACE MY_TABLESPACE
    DATAFILE 'tablespace.dbf'
    SIZE 1m;

-- ADDED
alter user test quota unlimited on MY_TABLESPACE;

-- ADDED TEST.
CREATE TABLE TEST.MY_TABLE
(
    ID              NUMBER(19) NOT NULL PRIMARY KEY
);

-- ADDED
grant all ON TEST.MY_TABLE to TEST;

CREATE ROLE MY_ROLE;

OracleContainer db = new OracleContainer("gvenzl/oracle-xe:slim")
                .withCopyFileToContainer(MountableFile.forClasspathResource("init.sql"), "/container-entrypoint-startdb.d/init.sql");

So, for me the TestContainer .withInitScript(...) isn't possible anymore as the TestContainer API now disabled the SYSTEM user, thus now I need to use the withCopyFileToContainer(...) and explicitly need to create objects in the TEST schema.

If this is the way it is intended, that's fine, and I found my way now.
But the usage is different from what it was, previously.

Thank you for your cooperation!

[kiview]

Thanks for sharing this. We might think about running withInitScript with elevated permissions (e.g. as SYSTEM) instead of the normal user. Would this be an Oracle DB idiomatic thing to do?

[tomdevroomen]

That would help in my situation.

I'm not an Oracle DB expert, maybe @gvenzl can answer this?