Answers: <p>Just use <code>docker-compose</code> (do not use Swarm if you do not really need its functionality). Set the password as an environment variable in a file called <code>.env</code>, set <code>.env</code> file permissions to <code>600</code>, and use the variable in the <code>docker-compose.yml</code></p>
  
Answers: CC BY-SA 4.0
Answers: 2024-09-26T18:27:50.243Z
Answers: Thank you for your response. I will probably do that.
Answers: Kevin
Answers: CC BY-SA 4.0
Answers: 2024-09-24T23:44:56.587Z
Answers: 2024-09-24T23:44:56.587Z
Answers: mikequentel
Body: <p>I am developing a Spring Boot RestAPI which relies on MariaDB and now I am deploying it to production on the VPS server. I already dockerized the Spring application and created a Docker Compose file which also deploys the MariaDB database. Everything works fine but I am a bit concerned about the security as the database password is stored in the compose file in plain text. I already tried to use Docker Swarm with Docker secrets which looked promising but it exposes additional ports on the server which I don't need as I have only one node. I am new to Docker Swarm and restricting access using iptables doesn't seem ideal. Another issue with Swarm I had was restricting access to the container from an external network. I use Nginx Reverse Proxy to add SSL but the service is also accessible directly from ip and default port if I don't restrict access using iptables. If there is a right way to use Swarm on VPS please point me in the right direction. The second thing I tried was using secrets with the compose file. It's supposed to be widely used but mapping a text file containing a non-encrypted secret to <code>/run/secrets/&lt;secret&gt;</code> in the container doesn't seem secure. It is convenient to prevent leaking the secrets on public git repository but that is not what I am looking for. Any suggestion on how to run a dockerized Spring Boot application with a database in production would be greatly appreciated.</p>
  
Tags: <docker-compose><security><docker-swarm><api><spring-boot>
Title: Deploying Dockerized App with Database to Production
UserDisplayName: Kevin
ThreadText: # Deploying Dockerized App with Database to Production
  
  (Asked by: username_0 on 2024-09-23)
  
  I am developing a Spring Boot RestAPI which relies on MariaDB and now I am deploying it to production on the VPS server. I already dockerized the Spring application and created a Docker Compose file which also deploys the MariaDB database. Everything works fine but I am a bit concerned about the security as the database password is stored in the compose file in plain text. I already tried to use Docker Swarm with Docker secrets which looked promising but it exposes additional ports on the server which I don't need as I have only one node. I am new to Docker Swarm and restricting access using iptables doesn't seem ideal. Another issue with Swarm I had was restricting access to the container from an external network. I use Nginx Reverse Proxy to add SSL but the service is also accessible directly from ip and default port if I don't restrict access using iptables. If there is a right way to use Swarm on VPS please point me in the right direction. The second thing I tried was using secrets with the compose file. It's supposed to be widely used but mapping a text file containing a non-encrypted secret to `/run/secrets/<secret>` in the container doesn't seem secure. It is convenient to prevent leaking the secrets on public git repository but that is not what I am looking for. Any suggestion on how to run a dockerized Spring Boot application with a database in production would be greatly appreciated.
  
  **Tags:** docker-compose, security, docker-swarm, api, spring-boot
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2024-09-24. Score: 0
  
  Just use `docker-compose` (do not use Swarm if you do not really need its functionality). Set the password as an environment variable in a file called `.env`, set `.env` file permissions to `600`, and use the variable in the `docker-compose.yml`
  
  > **Comments:**
  > **username_0**: Thank you for your response. I will probably do that.  
  
  ---
  
  