# Securing a Node.js + RethinkDB + TLS setup on Docker containers — Liran Tal

Intro

Canonical: https://lirantal.com/blog/securing-a-node-js-rethinkdb-tls-setup-on-docker-containers-84413d32dd39

![](/images/blog/1__C64ZrPVIob7heHW9At28Dw.jpeg)

### Intro

We use RethinkDB at work across different projects. It isn’t used for any sort of big-data applications, but rather as a NoSQL database, which spices things up with real-time updates, and relational tables support.

### Node.js Ecosystem

RethinkDB features an officially supported Node.js driver, as well as a community-maintained driver as well called **rethinkdbdash** which is promises-based, and provides connection pooling.

There is also a database migration tool called **rethinkdb-migrate** that aids in managing database changes such as schema changes, database seeding, tear up and tear down capabilities.

### RethinkDB Docker Setup

We’re going to use the official RethinkDB docker image from the docker hub and make use of **docker-compose.yml** to spin it up (later on you can add additional services to this setup).

A fair example for **docker-compose.yml**:

version: ‘2’

services:

rethinkdb:
image: rethinkdb:latest
ports:
\- “8181:8080”
\- “48015:28015”
volumes:
\- ./tls:/tls

### RethinkDB SSL Setup

The compose file mounts a local **tls** directory as a mapped volume inside the container. The **tls/** directory will contain our cert files, and the compose file is reflecting this.

### Certificates

To setup a secure connection we need to facilitate it using certificates so an initial technical step:

cd tls/

openssl genrsa -out key.pem 2048

openssl req -new -x509 -key key.pem -out cert.pem -days 3650 -subj ‘/CN=domain.com’

cp cert.pem ca.pem

Important notes:

*   The canonical name, which is the CN value is set to the domain to which the RethinkDB driver will connect to. Set here to domain.com as an example, **in your local development environment should probably be set to just localhost**.
*   Copying the cert to the certificate authority is actually an extra step required for slaves joining the cluster, so this isn’t mandatory.

### Start RethinkDB with SSL

Update the compose file to include a *command* configuration that starts the RethinkDB process with all the required SSL configuration

command: \[“rethinkdb”, “—tls-min-protocol”, “TLSv1”, “—tls-ciphers”, “EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:AES256-SHA”, “—canonical-address”, “domain.com”, “—http-tls-key”, “/tls/key.pem”, “—http-tls-cert”, “/tls/cert.pem”, “—driver-tls-key”, “/tls/key.pem”, “—driver-tls-cert”, “/tls/cert.pem”, “—bind” ,“all”\]

Important notes:

*   The first command arguments — *tls-min-protocol* and *— tls-ciphers* are for working with older SSL versions (applicable to Mac OS setups)
*   Notice the *— canonical-address* argument is also set to *domain.com*, and you might want to change that to localhost if you created the self-signed cert with a *CN=localhost*

You’ll notice there isn’t any cluster related configuration but you can add them as well if you need to so they can join the SSL connection: *— cluster-tls — cluster-tls-key /tls/key.pem — cluster-tls-cert /tls/cert.pem — cluster-tls-ca /tls/ca.pem*

### Node.js Driver Setup

The RethinkDB drivers support an *ssl* optional object which either sets the certificate using the *ca* property, or sets the *rejectUnauthorized* property to accept or reject self-signed certificates when connecting.

A snippet for the ssl configuration to pass to the driver:

ssl: {
rejectUnauthorized: false
// ca: fs.readFileSync(\_\_dirname + ’../tls/cert.pem’).toString().trim()
}

### RethinkDB Password Setup

Now that the connection is secured, it only makes sense to connect using a user/password which are not the default.

> Security Alert! RethinkDB ships with a default user and no password set which is insecure to say the least and was one of the main reasons for hundred of thousands of MongoDBs getting pwned on AWS a while back.

> PLEASE CHANGE THE DEFAULT USER ACCOUNT

To set it up, update the compose file to also include the *— initial-password* argument so you can set the default *admin* user’s password. For example:

command: \[“rethinkdb”, “—initial-password”, “changeMe”\]

Of course you need to append this argument to the rest of the command line options in the above compose file.

> Preferably, don’t store the password on the Dockerfile but rather use an environment variable or another method that doesn’t expose secrets.

Now, update the Node.js driver settings to use a user and password to connect:

{
user: ‘admin’,
password: ‘changeMe’
}

Congratulations! You’re now eligible to “Ready for Production” stickers.

Don’t worry, I already mailed them to your address.

## More writing

[All writing →](/blog)

*   Sep 5, 2026

    ### [Self-Hosting Hermes Agent with Matrix E2EE on Proxmox](/blog/self-host-hermes-agent-matrix-e2ee-proxmox)

*   Aug 2, 2026

    ### [The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph](/blog/practical-second-brain-llm-markdown-knowledge-graph)

*   Aug 1, 2026

    ### [Building a Second Brain with LLMs and AI Agents](/blog/building-second-brain-llms-ai-agents)


* * *

Liran Tal is the author of the book [Node.js Secure Coding: Defending Against Command Injection Vulnerabilities](https://www.nodejs-security.com/)

[Start Building Secure Node.js Applications ↗](https://www.nodejs-security.com/)

 [![](/_astro/nodejs-secure-coding-book-3d-style.DiTWpzFs_Z3c7s1.png)](https://www.nodejs-security.com/)