[Docker] ALPINE_DATABASE_PASSWORD from the secret

[gray380]

Hello,

Is there a possibility to set ALPINE_DATABASE_PASSWORD from the docker secret?
I mean in the docker-compose.yml.

best regards
Serhiy.

[nscuro]

Please don't create issues for questions, see https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#asking-questions

[nscuro]

@gray380 I just checked, and while it's not really documented, you can use the ALPINE_DATABASE_PASSWORD_FILE environment variable to specify a file from where the password shall be loaded.

If your Docker secret has the name database_password, then you'd set ALPINE_DATABASE_PASSWORD_FILE to /run/secrets/database_password.

The same is possible for other configuration options where passwords are provided, e.g.:

ALPINE_LDAP_BIND_PASSWORD_FILE
ALPINE_HTTP_PROXY_PASSWORD_FILE

[mendorf]

I also spent some time to find out how to make this work, probably this will help someone still searching on how to get the secret consumed by Dependency Track.

It is not clear from the documentation that the *_FILE property keys even exist. However, even if there seems to be some code the keys do not work at all.

Let alone ALPINE_APPLICATION_PROPERTIES. One needs to add it to the java runtime, which is only mentioned vaguely inside documentation.

This approach renders a _FILE property useless, because you basically are now able to directly include the password within the application.properties, if you do not care to have the remaining configuration details readable for others.
There is a similar issue #832 already open since 2020.

Hope this helps anyone to save time to figure out.

[nscuro]

@mendorf Just looked into it. ALPINE_DATABASE_PASSWORD_FILE not being used is a regression in Alpine. Raised a PR to resolve this: stevespringett/Alpine#557