TASIOMIND.DEV — OPERATIONAL▸▸▸FULL STACK DEVELOPER @ GWQ SERVICEPLUS AG▸▸▸FOUNDER — K8SGPT.AI▸▸▸OPEN SOURCE: ACTIVE▸▸▸DISTRIBUTED SYSTEMS / KUBERNETES / AI▸▸▸RUST + GO + PYTHON▸▸▸FIELD TESTED / STATUS — NOMINAL▸▸▸LOCATION: EUROPE/BERLIN▸▸▸TASIOMIND.DEV — OPERATIONAL▸▸▸FULL STACK DEVELOPER @ GWQ SERVICEPLUS AG▸▸▸FOUNDER — K8SGPT.AI▸▸▸OPEN SOURCE: ACTIVE▸▸▸DISTRIBUTED SYSTEMS / KUBERNETES / AI▸▸▸RUST + GO + PYTHON▸▸▸FIELD TESTED / STATUS — NOMINAL▸▸▸LOCATION: EUROPE/BERLIN▸▸▸
← docker

Passwords, secrets and environment variables inside Docker

July 27, 2021

Ziel

Passwoerter und Konfiguration in Docker sauber verwalten, ohne sie in Code oder Images einzubrennen.

Umgebung in docker-compose.yml

code
services:
  wordpress:
    image: wp-img
    restart: always
    environment:
      WORDPRESS_DB_HOST: mysql
      WORDPRESS_DB_NAME: myawesomedb
      WORDPRESS_DB_USER: myawesomeuser
      WORDPRESS_DB_PASSWORD: "oBw^^(&&ASJHGasb"
      DOMAIN_CURRENT_SITE: my.cooldomain.com

Im Code liest du die Variablen z.B. in PHP so aus:

code
define('DB_NAME', getenv('WORDPRESS_DB_NAME'));
define('DB_USER', getenv('WORDPRESS_DB_USER'));
define('DB_PASSWORD', getenv('WORDPRESS_DB_PASSWORD'));
define('DB_HOST', getenv('WORDPRESS_DB_HOST'));

.env Datei verwenden

.env haelt Werte ausserhalb des compose Files. Wichtig: niemals in Git committen.

code
services:
  wordpress:
    image: wordpress:6-fpm-alpine
    env_file: .env
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_USER: ${MYSQL_USER}
      WORDPRESS_DB_PASSWORD: ${MYSQL_PASSWORD}
      WORDPRESS_DB_NAME: wordpress

Beispiel .env:

code
MYSQL_USER=wpuser
MYSQL_PASSWORD=s3cr3t

docker run (ohne Compose)

code
docker run -e API_TOKEN=abc123 -e LOG_LEVEL=info my-image

Secrets (besser als ENV)

ENV Variablen sind im Container sichtbar (z.B. docker inspect). Fuer echte Secrets:

  • Docker Secrets (Swarm) oder
  • Secret Stores deines CI/CD Systems (GitHub Actions, GitLab, Bitbucket)

In Compose (Swarm Mode):

code
secrets:
  db_password:
    file: ./secrets/db_password.txt
services:
  app:
    secrets:
      - db_password

Best Practices

  • .env in .gitignore
  • Secrets nie ins Image kopieren
  • Unterschiedliche .env pro Umgebung (dev/staging/prod)
  • Klare Namenskonventionen (APP_, DB_, API_)

Links