For example I have a docker compose stack with a service and a db.
How do you handle the passwords? Is it better to store them in a .env file or is there something different entirely?

Also do the passwords have to be strong if the db is only available to the service through the docker network?

  • jormaig@programming.dev
    link
    fedilink
    arrow-up
    12
    ·
    10 months ago

    Docker has a secrets feature where you can mount a file containing a password into the container. It is not recommended to use environment variables because anyone outside the container can read the environment variables of a process. Then, the idea is that your service should support reading the secret from a file. Most services support it and if they don’t you should open an issue because that’s the current accepted practice

    • derpgon@programming.dev
      link
      fedilink
      arrow-up
      2
      ·
      10 months ago

      For services that don’t support file secrets, it’s possible to assign them to ENV variables and export them before app bootstrap (so pre-entrypoint of sorts) and build a custom docker image. That’s what I did for GL runner.

      Create your own entrypoint file. Read secret path from an ENV. Read file and assign to an ENV. The ENV containing the secret valie is not visible from the outside. If the service does not support ENV variable secret (like aforementioned GL runner) then it’s possible to use the env in a config file and an envsubst in the same entrypoint

      • object_Object@programming.dev
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        10 months ago

        If the value is still passed as an environment variable in the end, it can be read via /proc/:pid/environ from another container or from the host if they are both using the same UID (or has --cap-add SYS_PTRACE)

    • towerful@beehaw.org
      link
      fedilink
      arrow-up
      5
      ·
      10 months ago

      For passwords in software chains, I always think of them as API keys. So, making them 32 or 64 character random strings doesn’t seem ridiculous.

  • ses hat@lemmy.ml
    link
    fedilink
    arrow-up
    1
    ·
    9 months ago

    Well my concern is not at home, my problem is with vps, pwd for database,api keys… I have no idea how to approach this problem. I know that a good sysadmin can get everyting but at least i want to be more safe against average admins. For me the “trust” it is something over rated.