6

I have a docker image which is partially ready to work. To have it fully working I have to run

sudo docker run -d -p 80 --name myimage -e ADMIN_USER="user1" -e ADMIN_PASSWORD='password1' leonixyz/myimage:1.0

The first time the image gets executed my code configures the application inside.

This is handy because each time I need a new instance of the application, which has to be configured each time for a different user, I can pass different environment variables to docker run and my code will configure the container specifically for the new user.

Unfortunately, I see these variables cannot be removed from the container.

If I do:

sudo docker exec -it <container_id> bash

then I can see variables ADMIN_USER and ADMIN_PASSWORD are (obviously) still there.

I tried to unset ADMIN_PASSWORD on the end of my one-time-configuration code, but it doesn't work.

Also running unset ADMIN_PASSWORD from the bash shell in the running container won't work.

Is there a way to remove an environment variable from a container, once this has been started?

Thanks


Edit as pointed out it's better to not pass secrets at all via environment variables, a great workaround is explained here https://github.com/docker/docker/issues/13490#issuecomment-162125128

4 Answers 4

3

The only reasonable way to "unset" environment variables holding credentials is to not set them in the first place. Don't use environment variables for credentials, or "secrets", in general.

The following provides a good summary: https://github.com/docker/docker/issues/13490 .

1
0

What about the opposite approach? Instead of passing enviroment variables on runtime, you could set your entrypoint to something like this:

    ENTRYPOINT export ADMIN_USER="user1" \
               && export ADMIN_PASSWORD='password1' \
               && entrypoint.sh

Another approach would be to pass the desired variables as actual arguments to your entrypoint script.

0

If you must set the env var (for whatever reason), this is covered in the Dockerfile best practices now.

FROM alpine
RUN export ADMIN_USER="mark" \
    && echo $ADMIN_USER > ./mark \
    && unset ADMIN_USER
CMD sh
0

You can now (Sept. 2020) pass variables which won't be part of the final image, with

docker build --no-cache --progress=plain --secret id=mysecret,src=mysecret.txt

Associated with a Dockerfile including

# shows secret from default secret location:
RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret

This uses docker build with BuildKit.

See more at "Docker and securing passwords".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.