docker-compose secrets without swarm

Question

I don't want to use docker secrets with swarm and I discovered that it's possible to do that. Basically docker just mounts /run/secrets inside docker container, but when I enter the newly built docker container and do echo $POSTGRES_PASSWORD_FILE I get the path to my secret file.

root@94a0f092eeb1:/# echo $POSTGRES_PASSWORD_FILE
/run/secrets/db_password

Here is my docker-compose.yml file

version: '3.1'
services:
    postgres:
        image: postgres:9.4
        container_name: postgres
        environment:
            POSTGRES_USER: "db_user"
            POSTGRES_PASSWORD_FILE: /run/secrets/db_password
            POSTGRES_DB: "my_db"
        secrets:
          - db_password
        volumes:
            - ./postgres:/var/lib/postgresql/data
        expose:
            - 5432
secrets:
   db_password:
     file: ./POSTGRES_PASSWORD.txt

Is my password set correctly/ Is there something wrong with my file?

Hello! Not sure, what is the issue here? What do you expect from "echo $POSTGRES_PASSWORD_FILE"? — Boris, Jul 06 '20 at 05:42

score 15 · Accepted Answer · answered Dec 12 '18 at 22:00

15

Ok, so all I had to do is to remove

volumes:
    - ./postgres:/var/lib/postgresql/data

I'll try to figure out how to fix it, but essentially I answered my own question.

Here is a working example of docker-compose.yml file with secrets without using docker swarm:

version: '3.1'
services:
    postgres:
        image: postgres:9.4
        container_name: postgres
        environment:
            POSTGRES_USER: "db_user"
            POSTGRES_PASSWORD_FILE: /run/secrets/db_password
            POSTGRES_DB: "my_db"
        secrets:
          - db_password
        ports:
            - "8888:5432"
secrets:
   db_password:
     file: ./POSTGRES_PASSWORD

answered Dec 12 '18 at 22:00

HereHere

734
1
7
24

4

@stackoverflowed: From security perspective, not too secure. Just wanted to know if it's possible to do all of this without docker swarm – HereHere Feb 21 '19 at 10:01
4

it also means that you can now push your docker-compose.yml in your git repo without your password in it – leszek.hanusz May 16 '19 at 13:08
2

I'm interested in the concept. It seems that the same could be accomplished through a `.env` file in .gitignore. The more interesting question is how to share these secrets with your team. – trey-jones Oct 21 '19 at 19:02
1

In all the examples I have gone through never found a sample for secret file for multiple secrets key-value pair. Is this a possibility for multiple parameters in one secret file? – Jinna Balu May 05 '20 at 12:40
@JinnaBalu unless the image you’re using supports reading multiple parameters from one file / env variable, no. – bfontaine Jan 05 '22 at 11:00
It should support – Jinna Balu Jan 05 '22 at 13:29
This works but the local file has to have very broad permissions to ensure that the Postgres container user can read it. That defeats the purpose of making it secret. – slhck Apr 12 '22 at 12:00

docker-compose secrets without swarm

1 Answers1

Linked