Module pg_client 

Pure builders for the Postgres export/import client invocation (argv + PG* env); the credential non-leak rule (password in env, never argv) lives here. Pure builders for the SQL export/import client invocation (Postgres + MySQL) that the driver runs inside run_ephemeral: the argv and the process environment.

The credential non-leak rule lives here

The password rides in an environment variable (PGPASSWORD for Postgres, MYSQL_PWD for MySQL), NEVER in argv. Both argv and the container environment are visible to a privileged docker inspect, but argv leaks far more broadly — it shows in every process listing (ps, /proc/<pid>/cmdline) inside and outside the container, to any local observer, no daemon privilege required — whereas the container environment is only reachable with daemon/inspect access. Env is therefore the smaller exposure (not zero), and it is the right choice over argv. No DSN string is assembled at all: the discrete PG* / MYSQL* connection variables connect the client, so there is no connection string to accidentally format! into a log. The only secret is the password env var.

--data-only vs full

--data-only emits/restores ONLY the table data; the target keeps its OWN migrated schema (Phase 1 is data-only: app data, no identity/RBAC/routing). A full export carries schema + data. --no-owner/--no-privileges keep a restore from trying to reassign ownership/ACLs across environments, and pg_restore --exit-on-error makes a failed object abort loudly rather than leave a half-restored database.

Kept pure so the data-only divergence and the cred-placement invariant are unit-mutation-gated in the merge gate.

Structs

MysqlConnection

A resolved MySQL connection target for the client. The password goes in MYSQL_PWD (the env the mysql/mysqldump clients read), never argv.

PgConnection

A resolved Postgres connection target for the client. Assembled by the driver from the sealed-credential unseal + the resolved replica endpoint; consumed only to emit the PG* environment.

SqlInvocation

A fully-built client invocation: the argv (no credential) + the environment (the credential), ready to hand to run_ephemeral(image, argv, env, …).

Functions

mysql_restore_invocation

Build the mysql invocation for an IMPORT (reads the SQL dump from stdin). Host/port/ user are explicit (conn_args) so the client connects over TCP, not the local socket. A FULL bundle’s dump carries its own USE <db> (from --databases), so no positional db is needed; a --data-only dump has none, so the target <db> is named on the command line. The database name is NOT a credential, so passing it in argv is fine.

mysqldump_invocation

Build the mysqldump invocation for an EXPORT. --single-transaction takes a consistent snapshot without locking (InnoDB); --no-tablespaces avoids the PROCESS privilege requirement. Host/port/user are explicit (conn_args) because mysqldump ignores MYSQL_HOST. A FULL dump emits schema + data under --databases <db> (so the stream carries CREATE DATABASE/USE); --data-only emits only the rows for <db> (--no-create-info), restored into the target’s existing schema. No --connect-timeout: mysqldump does not register it (unknown variable); the overall ephemeral-run timeout bounds a stuck dump instead.

pg_dump_invocation

Build the pg_dump invocation for an EXPORT. Custom format (-Fc): compressed and the natural input to pg_restore. --data-only emits only the data AND EXCLUDES the host-owned migration ledger’s rows (boatramp_migrations.*): the ledger is a schema INSIDE the tenant database, so a plain --data-only dump would carry its rows and a pg_restore --data-only --exit-on-error into the already-migrated target (the matching-fingerprint case — the PRIMARY use) would hit a primary-key conflict on the ledger and abort. Excluding it keeps the target’s own boatramp_migrations ledger intact (the stated property).

pg_restore_invocation

Build the pg_restore invocation for an IMPORT (reads the custom-format dump from stdin). --data-only restores only the data into the target’s existing migrated schema; --exit-on-error aborts loudly on the first failed object. Unlike psql/ pg_dump, pg_restore does NOT infer the target from PGDATABASE — without -d (restore into a database) or -f (emit a script) it refuses with “one of -d/–dbname and -f/–file must be specified”; so the target database is named with -d (the host/ port/user/password still come from the env, and the db name is not a credential).