Using docker secrets to pass sensitive information via "_FILE" variables.

[vaerh]

Hi Denis, can you review this patch?
We would like to remove all sensitive information from the environment variable file and use docker secrets to pass it.

[fiftin]

Hi @vaerh ,

It is very useful improvement. Сan it break the old behavior?

[vaerh]

I hope it doesn't break. This patch is made to look like a working implementation for mariadb-docker
And we have the production stack with these changes.

[fiftin]

Do you have any docs for this feature?

[vaerh]

I'm sorry to be late with the reply.
Maybe not invent anything and slightly correct the excellent description from the MySQL Team?

Docker Secrets
As an alternative to passing sensitive information via environment variables, _FILE may be appended to the previously listed environment variables, causing the initialization script to load the values for those variables from files present in the container. In particular, this can be used to load passwords from Docker secrets stored in /run/secrets/<secret_name> files. For example docker-compose.yml:

semaphore:
    restart: unless-stopped
    ports:
      - 3000:3000
    image: semaphoreui/semaphore:latest
    environment:
      SEMAPHORE_DB_PASS: /run/secrets/AnsibleSemaphoreMySQLPassword

Currently, this is only supported for SEMAPHORE_DB_USER, SEMAPHORE_DB_PASS, SEMAPHORE_ADMIN, SEMAPHORE_ADMIN_PASSWORD, SEMAPHORE_LDAP_PASSWORD and SEMAPHORE_ACCESS_KEY_ENCRYPTION.