Answers: <p>Here's a solution I've used in cases like this - I utilize <a href="http://docs.ansible.com/ansible/2.4/intro.html" rel="nofollow noreferrer">Ansible</a> to manage Docker containers, and <a href="http://docs.ansible.com/ansible/2.4/vault.html" rel="nofollow noreferrer">Ansible Vault</a> to store secrets for those containers. </p>
  
  <h3>Ansible Playbook to run MongoDB container</h3>
  
  <p>Your <code>playbook.yml</code> may look something like this:</p>
  
  <pre><code>- name: run mongodb docker container
    docker_container:
      name: mongo-container
      image: mongo
      ports:
        - "27017:27017"
      env:
        MONGO_INITDB_DATABASE: "{{secret_db_name}}"
        MONGO_INITDB_ROOT_USERNAME: "{{secret_db_user}}"
        MONGO_INITDB_ROOT_PASSWORD: "{{secret_db_pass}}"
  </code></pre>
  
  <ul>
  <li>As you might notice, the <a href="http://docs.ansible.com/ansible/latest/docker_container_module.html" rel="nofollow noreferrer"><code>docker_container</code></a> syntax looks a lot like what you'd write in a Docker Compose YML file.</li>
  <li>The difference is that your <em>secrets</em> are managed in variables (the <code>{{}}</code> is <a href="http://docs.ansible.com/ansible/latest/playbooks_variables.html#using-variables-about-jinja2" rel="nofollow noreferrer">Ansible Jinja2 variables</a>).</li>
  <li>Here's a list of <a href="http://docs.ansible.com/ansible/latest/list_of_cloud_modules.html#docker" rel="nofollow noreferrer">Ansible Modules</a> for interacting with Docker.</li>
  </ul>
  
  <h3>Vault file to manage your <code>mongodb</code> secrets</h3>
  
  <p>The <code>vault.yml</code> file would contain the definitions of your secrets in an encrypted form.</p>
  
  <pre><code>secret_db_name: foodb
  secret_db_user: foo
  secret_db_pass: bar@123
  </code></pre>
  
  <p>You can use <a href="http://docs.ansible.com/ansible/2.4/vault.html" rel="nofollow noreferrer"><code>ansible-vault</code> commands</a> to create encrypted files  (for e.g in version-control). </p>
  
  <h3>Getting it all together</h3>
  
  <p>When you want to run your Docker container, you would run an Ansible command</p>
  
  <p><code>ansible-playbook playbook.yml --ask-vault-pass</code></p>
  
  <p>Which would </p>
  
  <ul>
  <li>ask you for your vault password file, </li>
  <li>decrypt the vault file and pass the variables to the playbook;</li>
  <li>run the docker mongodb container with your secret credentials </li>
  </ul>
  
  <p>All whilst ensuring your credentials are not publicly visible.</p>
  
  <h3>Notes</h3>
  
  <ul>
  <li>I've used this approach to provision Dockerized databases on remote managed servers in a declarative way.</li>
  <li>You introduce one more tool, a 'wrapper' around Docker. In my experience DevOps <em>toolchains</em> work better than utilizing single tools. However, this may or may not be a constraint for you. </li>
  </ul>
  
Answers: CC BY-SA 3.0
Answers: 2018-03-10T02:48:11.400Z
Answers: 2018-03-10T02:52:16.913Z
Answers: 2018-03-10T02:52:16.913Z
Answers: Vish
Answers: <p>Secrets support for mongo is built in. You can see in that <a href="https://github.com/docker-library/mongo/blob/58bdba62b65b1d1e1ea5cbde54c1682f120e0676/3.0/docker-entrypoint.sh#L34-L37" rel="nofollow noreferrer">image's entrypoint script</a> that if you add <code>_FILE</code> to end of username/password values it will pull from those secret files.</p>
  
  <p>As for .js files, if you're storing decrypted passwords in those files, you'd need to make a custom entrypoint script or something that will take envvars you're passing in for which secrets to use and run a <code>jq</code> or <code>sed</code> on the file to replace I guess. You can store the .js files themselves in a secret as longas its smaller than 500Kb (max size of a secret).</p>
  
Answers: CC BY-SA 3.0
Answers: 2018-03-12T02:52:15.933Z
Answers: 2018-03-12T02:52:15.933Z
Answers: Bret Fisher
Body: <p>I'm using this docker image <a href="https://hub.docker.com/_/mongo/" rel="nofollow noreferrer">https://hub.docker.com/_/mongo/</a>. That image provides a way of initializing a mongodb root database user with env variables which I can specify in the compose file as follows:</p>
  
  <pre><code>environment:
    - MONGO_INITDB_DATABASE=db
    - MONGO_INITDB_ROOT_USERNAME=root
    - MONGO_INITDB_ROOT_PASSWORD=pass
  </code></pre>
  
  <p>It seems storing the password in config files is not very secure. How can I use more secure ways (i.e. docker secrets) to init the root user in this case? Same thing for initdb files, which I need to copy to the container and may as well contain more credentials.</p>
  
  <p>I wonder if anyone here found a more secure way of handling this.</p>
  
Tags: <docker><docker-compose><security><docker-swarm><databases>
Title: Docker MongoDB image - How to specify credentials other than in the compose file?
UserDisplayName: joe.js
ThreadText: # Docker MongoDB image - How to specify credentials other than in the compose file?
  
  (Asked by: username_0 on 2018-03-10)
  
  I'm using this docker image <https://hub.docker.com/_/mongo/>. That image provides a way of initializing a mongodb root database user with env variables which I can specify in the compose file as follows:
  
  ```
  environment:
    - MONGO_INITDB_DATABASE=db
    - MONGO_INITDB_ROOT_USERNAME=root
    - MONGO_INITDB_ROOT_PASSWORD=pass
  
  ```
  
  It seems storing the password in config files is not very secure. How can I use more secure ways (i.e. docker secrets) to init the root user in this case? Same thing for initdb files, which I need to copy to the container and may as well contain more credentials.
  
  I wonder if anyone here found a more secure way of handling this.
  
  **Tags:** docker, docker-compose, security, docker-swarm, databases
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2018-03-12. Score: 3 | Accepted answer
  
  Secrets support for mongo is built in. You can see in that [image's entrypoint script](https://github.com/docker-library/mongo/blob/58bdba62b65b1d1e1ea5cbde54c1682f120e0676/3.0/docker-entrypoint.sh#L34-L37) that if you add `_FILE` to end of username/password values it will pull from those secret files.
  
  As for .js files, if you're storing decrypted passwords in those files, you'd need to make a custom entrypoint script or something that will take envvars you're passing in for which secrets to use and run a `jq` or `sed` on the file to replace I guess. You can store the .js files themselves in a secret as longas its smaller than 500Kb (max size of a secret).
  
  
  ---
  
  ### Answer by username_1 on 2018-03-10. Score: 2
  
  Here's a solution I've used in cases like this - I utilize [Ansible](http://docs.ansible.com/ansible/2.4/intro.html) to manage Docker containers, and [Ansible Vault](http://docs.ansible.com/ansible/2.4/vault.html) to store secrets for those containers.
  
  ### Ansible Playbook to run MongoDB container
  
  Your `playbook.yml` may look something like this:
  
  ```
  - name: run mongodb docker container
    docker_container:
      name: mongo-container
      image: mongo
      ports:
        - "27017:27017"
      env:
        MONGO_INITDB_DATABASE: "{{secret_db_name}}"
        MONGO_INITDB_ROOT_USERNAME: "{{secret_db_user}}"
        MONGO_INITDB_ROOT_PASSWORD: "{{secret_db_pass}}"
  
  ```
  
  * As you might notice, the [`docker_container`](http://docs.ansible.com/ansible/latest/docker_container_module.html) syntax looks a lot like what you'd write in a Docker Compose YML file.
  * The difference is that your *secrets* are managed in variables (the `{{}}` is [Ansible Jinja2 variables](http://docs.ansible.com/ansible/latest/playbooks_variables.html#using-variables-about-jinja2)).
  * Here's a list of [Ansible Modules](http://docs.ansible.com/ansible/latest/list_of_cloud_modules.html#docker) for interacting with Docker.
  
  ### Vault file to manage your `mongodb` secrets
  
  The `vault.yml` file would contain the definitions of your secrets in an encrypted form.
  
  ```
  secret_db_name: foodb
  secret_db_user: foo
  secret_db_pass: bar@123
  
  ```
  
  You can use [`ansible-vault` commands](http://docs.ansible.com/ansible/2.4/vault.html) to create encrypted files (for e.g in version-control).
  
  ### Getting it all together
  
  When you want to run your Docker container, you would run an Ansible command
  
  `ansible-playbook playbook.yml --ask-vault-pass`
  
  Which would
  
  * ask you for your vault password file,
  * decrypt the vault file and pass the variables to the playbook;
  * run the docker mongodb container with your secret credentials
  
  All whilst ensuring your credentials are not publicly visible.
  
  ### Notes
  
  * I've used this approach to provision Dockerized databases on remote managed servers in a declarative way.
  * You introduce one more tool, a 'wrapper' around Docker. In my experience DevOps *toolchains* work better than utilizing single tools. However, this may or may not be a constraint for you.
  
  
  ---
  
  