Starting without plain text db password in docker-compose ENV

[TheNighthawk99]

Hello,
I am trying to install EJBCA as docker container and I have already followed the YouTube tutorial on how to start a production-like system. It is very detailed but nothing is documented on the matter below.
In terms of security, how we can avoid to pass very unsecured plain text database passwords through the EJBCA docker env as in the video?
MariaDB container can be started up using docker secrets, is the same for EJBCA?

I had tried to find something in the documentation, but I did not find anything useful.

thank you.
Regards.

[primetomas]

There is some example for this in the EJBCA helm chart repo. https://github.com/Keyfactor/ejbca-community-helm

[TheNighthawk99]

I used Docker Secrets with following:

services:
  mariadb:
    image: mariadb:latest
    volumes:
      - ejbca_db010:/var/lib/mysql:rw
    environment:
      MYSQL_USER: ejbca
      MYSQL_DATABASE: ejbca
      MYSQL_PASSWORD_FILE: /run/secrets/mariadb_user_pwd
      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/root_password
    secrets:
      - mariadb_user_pwd
      - root_password
    networks:
      - backend_net
      
  ejbca:
    image: keyfactor/ejbca-ce:latest
    hostname: 172.16.1.223
    depends_on:
      - mariadb
    ports:
      - 8082:80
      - 8443:443
    environment:
      DATABASE_JDBC_URL: jdbc:mariadb://mariadb:3306/ejbca?characterEncoding=UTF-8
      LOG_LEVEL_APP: INFO
      LOG_LEVEL_SERVER: INFO
      TLS_SETUP_ENABLED: "true"
      DATABASE_USER: ejbca
      DATABASE_PASSWORD_FILE: /run/secrets/mariadb_user_pwd
    secrets:
      - mariadb_user_pwd
    networks:
      - backend_net
    deploy:
      restart_policy:
        condition: none
        
secrets:
  mariadb_user_pwd:
    external: true
  root_password:
    external: true

networks:
  backend_net:
    name: mariadb_backend_network
    external: true

volumes:
  ejbca_db010:
    driver: local

I cannot understand if the system does not accept the DATABASE_PASSWORD_FILE env or anything else.
If I use DATABASE_PASSWORD with plain text for both containers, the EJBCA container connects to mariadb and begins the installation.

[primetomas]

I don't know how Docker Secrets work myself, but the docker documentation page says that it only works when using Docker Swarm?

Talking to my colleagues they say that having the secret in secrets manager like Vault, Open Bao, or simialar is the common usage.

[primetomas]

docker secrets seems to work completely differently, EJBCA does not read a variable DATABASE_PASSWORD_FILE. It reads DATABASE_PASSWORD and when using a secrets manager the environment variable is dynamically provided at runtime by the secrets manager.

[TheNighthawk99]

Ok, let's look elsewhere for alternatives.
thank you.