Try It Out

For a quick test, print the version information:

docker run --rm reg.mini.dev/postgrest postgrest --version

PostgREST needs a Postgres database to connect to, so start one on a shared network:

docker network create postgrest-net

docker run --rm -d --name postgres --network postgrest-net \
  -e POSTGRES_PASSWORD=Minimus! \
  reg.mini.dev/postgres

Create a schema, a table with a few sample rows, and the roles PostgREST will use — one for the API connection itself, and one that governs what unauthenticated requests can see:

cat <<EOF > setup.sql
create schema api;

create table api.todos (
  id int primary key generated by default as identity,
  done boolean not null default false,
  task text not null
);

insert into api.todos (task) values ('finish tutorial'), ('pat self on back');

create role web_anon nologin;
grant usage on schema api to web_anon;
grant select on api.todos to web_anon;

create role authenticator noinherit login password 'Minimus!';
grant web_anon to authenticator;
EOF

Apply it against the running Postgres container:

docker exec -i postgres psql -U postgres < setup.sql

Run PostgREST against that database, telling it which schema to expose and which role to use for unauthenticated requests. (The %21 in the connection URI is a percent-encoded ! — this keeps the shell from misinterpreting !@ as history expansion while libpq still decodes it back to the real password):

docker run --rm -d --name my-minimus-postgrest \
  --network postgrest-net -p 3000:3000 \
  -e PGRST_DB_URI="postgres://authenticator:Minimus%21@postgres:5432/postgres" \
  -e PGRST_DB_SCHEMAS="api" \
  -e PGRST_DB_ANON_ROLE="web_anon" \
  reg.mini.dev/postgrest

Query the API PostgREST generated from the api.todos table:

curl http://localhost:3000/todos

You should see the sample rows returned as JSON:

[{"id":1,"done":false,"task":"finish tutorial"},{"id":2,"done":false,"task":"pat self on back"}]

Technical Considerations

The PostgREST image provided by Minimus is a slim, security-hardened alternative to the public image from Docker Hub. The images are largely interchangeable, with a few differences as noted below.

1. The PostgREST process runs as nonroot as user 1000, matching the public image.
2. Drill down on the version specification tab to see the default user, listening ports, entrypoint, volumes, environment variables, etc.

A hardened, minimal image that will remain more secure for the long run and accrue vulnerabilities at a slower rate.

• See the risk reduction dashboard for a detailed CVE comparison over the past 30 days.
• Review the compliance report to see the default hardening and security configurations for the image.

Terms & Info

This catalog is published by Minimus. All product names, logos, and marks, other than those belonging to Minimus, shown are owned by their respective rights holders and appear here only to identify the open source software each image contains. Minimus claims no ownership of those marks and implies no affiliation with, endorsement by, certification by, or sponsorship by any rights holder.

Images are provided "as-is" without warranty of any kind. "Hardened" refers to the security configuration applied at the time of build and does not constitute a guarantee of ongoing security or absence of vulnerabilities. The free tier is provided without support, SLA, or guaranteed patching timelines. Security updates may be applied to paid subscriptions before or instead of free tier images. By pulling or using any image you agree to our Terms of Use.