Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for secrets #1284

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

jlisher
Copy link

@jlisher jlisher commented May 12, 2022

Added support for using secrets to store passwords and secrets.

The file /etc/cont-init.d/02-load-secrets, added to the base image, fetches the secrets from /run/secrets/ and stores them as new environment variables by creating a file with the name of the secret in /run/s6/container_environment/. The s6 init system will then make the secrets available as environment variables.
Note that there doesn't need to be an environment variable defining the location of the secrets, the existence of the secret in /run/secrets/ (the default location) will make it available to the container. This should help prevent the need to edit any init or service run scripts.

There is also a SECRETS_DIR environment variable added to the env.example file. This should be used to specify the directory on the host where the secrets are stored. gen-passwords.sh has also been updated to use SECRETS_DIR as the location to store the generated secrets.

Edit: I just realised the environment variables could be left to exist and the use of secrets can be optional, the secrets will only replace the environment variables if they exist, otherwise the environment variables will remain untouched.

@saghul
Copy link
Member

saghul commented Jun 13, 2022

Thoughts @aaronkvanmeerten ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants