For example I have a docker compose stack with a service and a db.
How do you handle the passwords? Is it better to store them in a .env file or is there something different entirely?
Also do the passwords have to be strong if the db is only available to the service through the docker network?
You must log in or register to comment.
Docker has a secrets feature where you can mount a file containing a password into the container. It is not recommended to use environment variables because anyone outside the container can read the environment variables of a process. Then, the idea is that your service should support reading the secret from a file. Most services support it and if they don’t you should open an issue because that’s the current accepted practice
regarding docker secrets: what @jormaig@programming.dev said, examples for doing this are here: https://docs.docker.com/compose/use-secrets/
regarding passwords: maybe you don’t “have to”, but if i’d argue it’s important to build a habit of never using weak passwords anywhere. using strong passwords shouldn’t be/feel like an extra step but part of the normal workflow.
For passwords in software chains, I always think of them as API keys. So, making them 32 or 64 character random strings doesn’t seem ridiculous.
Well my concern is not at home, my problem is with vps, pwd for database,api keys… I have no idea how to approach this problem. I know that a good sysadmin can get everyting but at least i want to be more safe against average admins. For me the “trust” it is something over rated.
