Best practice for docker compose passwords? (lemmy.zip)

submitted 1 year ago by hyper@lemmy.zip to c/docker@programming.dev

7 comments fedilink hide all child comments

For example I have a docker compose stack with a service and a db.
How do you handle the passwords? Is it better to store them in a .env file or is there something different entirely?

Also do the passwords have to be strong if the db is only available to the service through the docker network?

you are viewing a single comment's thread
view the rest of the comments

[-] derpgon@programming.dev 2 points 1 year ago

For services that don't support file secrets, it's possible to assign them to ENV variables and export them before app bootstrap (so pre-entrypoint of sorts) and build a custom docker image. That's what I did for GL runner.

Create your own entrypoint file. Read secret path from an ENV. Read file and assign to an ENV. The ENV containing the secret valie is not visible from the outside. If the service does not support ENV variable secret (like aforementioned GL runner) then it's possible to use the env in a config file and an envsubst in the same entrypoint

[-] object_Object@programming.dev 2 points 1 year ago* (last edited 1 year ago)

If the value is still passed as an environment variable in the end, it can be read via /proc/:pid/environ from another container or from the host if they are both using the same UID (or has --cap-add SYS_PTRACE)

[-] derpgon@programming.dev 1 points 1 year ago

Oh, didn't think about that. Well, at least it works.

this post was submitted on 14 Aug 2023

20 points (100.0% liked)

Docker

1100 readers

2 users here now

founded 1 year ago

MODERATORS

erlingur@programming.dev

ProgramPhoenix@programming.dev

Ategon@programming.dev