<p>Here's a solution I've used in cases like this - I utilize <a href="http://docs.ansible.com/ansible/2.4/intro.html" rel="nofollow noreferrer">Ansible</a> to manage Docker containers, and <a href="http://docs.ansible.com/ansible/2.4/vault.html" rel="nofollow noreferrer">Ansible Vault</a> to store secrets for those containers. </p>

<h3>Ansible Playbook to run MongoDB container</h3>

<p>Your <code>playbook.yml</code> may look something like this:</p>

<pre><code>- name: run mongodb docker container
  docker_container:
    name: mongo-container
    image: mongo
    ports:
      - "27017:27017"
    env:
      MONGO_INITDB_DATABASE: "{{secret_db_name}}"
      MONGO_INITDB_ROOT_USERNAME: "{{secret_db_user}}"
      MONGO_INITDB_ROOT_PASSWORD: "{{secret_db_pass}}"
</code></pre>

<ul>
<li>As you might notice, the <a href="http://docs.ansible.com/ansible/latest/docker_container_module.html" rel="nofollow noreferrer"><code>docker_container</code></a> syntax looks a lot like what you'd write in a Docker Compose YML file.</li>
<li>The difference is that your <em>secrets</em> are managed in variables (the <code>{{}}</code> is <a href="http://docs.ansible.com/ansible/latest/playbooks_variables.html#using-variables-about-jinja2" rel="nofollow noreferrer">Ansible Jinja2 variables</a>).</li>
<li>Here's a list of <a href="http://docs.ansible.com/ansible/latest/list_of_cloud_modules.html#docker" rel="nofollow noreferrer">Ansible Modules</a> for interacting with Docker.</li>
</ul>

<h3>Vault file to manage your <code>mongodb</code> secrets</h3>

<p>The <code>vault.yml</code> file would contain the definitions of your secrets in an encrypted form.</p>

<pre><code>secret_db_name: foodb
secret_db_user: foo
secret_db_pass: bar@123
</code></pre>

<p>You can use <a href="http://docs.ansible.com/ansible/2.4/vault.html" rel="nofollow noreferrer"><code>ansible-vault</code> commands</a> to create encrypted files  (for e.g in version-control). </p>

<h3>Getting it all together</h3>

<p>When you want to run your Docker container, you would run an Ansible command</p>

<p><code>ansible-playbook playbook.yml --ask-vault-pass</code></p>

<p>Which would </p>

<ul>
<li>ask you for your vault password file, </li>
<li>decrypt the vault file and pass the variables to the playbook;</li>
<li>run the docker mongodb container with your secret credentials </li>
</ul>

<p>All whilst ensuring your credentials are not publicly visible.</p>

<h3>Notes</h3>

<ul>
<li>I've used this approach to provision Dockerized databases on remote managed servers in a declarative way.</li>
<li>You introduce one more tool, a 'wrapper' around Docker. In my experience DevOps <em>toolchains</em> work better than utilizing single tools. However, this may or may not be a constraint for you. </li>
</ul>

CC BY-SA 3.0
2018-03-10T02:48:11.400Z
2018-03-10T02:52:16.913Z
2018-03-10T02:52:16.913Z
Vish
<p>Secrets support for mongo is built in. You can see in that <a href="https://github.com/docker-library/mongo/blob/58bdba62b65b1d1e1ea5cbde54c1682f120e0676/3.0/docker-entrypoint.sh#L34-L37" rel="nofollow noreferrer">image's entrypoint script</a> that if you add <code>_FILE</code> to end of username/password values it will pull from those secret files.</p>

<p>As for .js files, if you're storing decrypted passwords in those files, you'd need to make a custom entrypoint script or something that will take envvars you're passing in for which secrets to use and run a <code>jq</code> or <code>sed</code> on the file to replace I guess. You can store the .js files themselves in a secret as longas its smaller than 500Kb (max size of a secret).</p>

CC BY-SA 3.0
2018-03-12T02:52:15.933Z
2018-03-12T02:52:15.933Z
Bret Fisher
<p>I'm using this docker image <a href="https://hub.docker.com/_/mongo/" rel="nofollow noreferrer">https://hub.docker.com/_/mongo/</a>. That image provides a way of initializing a mongodb root database user with env variables which I can specify in the compose file as follows:</p>

<pre><code>environment:
  - MONGO_INITDB_DATABASE=db
  - MONGO_INITDB_ROOT_USERNAME=root
  - MONGO_INITDB_ROOT_PASSWORD=pass
</code></pre>

<p>It seems storing the password in config files is not very secure. How can I use more secure ways (i.e. docker secrets) to init the root user in this case? Same thing for initdb files, which I need to copy to the container and may as well contain more credentials.</p>

<p>I wonder if anyone here found a more secure way of handling this.</p>

<docker><docker-compose><security><docker-swarm><databases>
Docker MongoDB image - How to specify credentials other than in the compose file?
joe.js
# Docker MongoDB image - How to specify credentials other than in the compose file?

(Asked by: username_0 on 2018-03-10)

I'm using this docker image https://hub.docker.com/_/mongo/. That image provides a way of initializing a mongodb root database user with env variables which I can specify in the compose file as follows:
environment:
  - MONGO_INITDB_DATABASE=db
  - MONGO_INITDB_ROOT_USERNAME=root
  - MONGO_INITDB_ROOT_PASSWORD=pass

It seems storing the password in config files is not very secure. How can I use more secure ways (i.e. docker secrets) to init the root user in this case? Same thing for initdb files, which I need to copy to the container and may as well contain more credentials.
I wonder if anyone here found a more secure way of handling this.

**Tags:** docker, docker-compose, security, docker-swarm, databases


---

## 2 answers

### Answer by username_2 on 2018-03-12. Score: 3 | Accepted answer

Secrets support for mongo is built in. You can see in that [image's entrypoint script](https://github.com/docker-library/mongo/blob/58bdba62b65b1d1e1ea5cbde54c1682f120e0676/3.0/docker-entrypoint.sh#L34-L37) that if you add `_FILE` to end of username/password values it will pull from those secret files.

As for .js files, if you're storing decrypted passwords in those files, you'd need to make a custom entrypoint script or something that will take envvars you're passing in for which secrets to use and run a `jq` or `sed` on the file to replace I guess. You can store the .js files themselves in a secret as longas its smaller than 500Kb (max size of a secret).


---

### Answer by username_1 on 2018-03-10. Score: 2

Here's a solution I've used in cases like this - I utilize Ansible to manage Docker containers, and Ansible Vault to store secrets for those containers. 
Ansible Playbook to run MongoDB container
Your playbook.yml may look something like this:
- name: run mongodb docker container
  docker_container:
    name: mongo-container
    image: mongo
    ports:
      - "27017:27017"
    env:
      MONGO_INITDB_DATABASE: "{{secret_db_name}}"
      MONGO_INITDB_ROOT_USERNAME: "{{secret_db_user}}"
      MONGO_INITDB_ROOT_PASSWORD: "{{secret_db_pass}}"


As you might notice, the docker_container syntax looks a lot like what you'd write in a Docker Compose YML file.
The difference is that your secrets are managed in variables (the {{}} is Ansible Jinja2 variables).
Here's a list of Ansible Modules for interacting with Docker.

Vault file to manage your mongodb secrets
The vault.yml file would contain the definitions of your secrets in an encrypted form.
secret_db_name: foodb
secret_db_user: foo
secret_db_pass: bar@123

You can use ansible-vault commands to create encrypted files  (for e.g in version-control). 
Getting it all together
When you want to run your Docker container, you would run an Ansible command
ansible-playbook playbook.yml --ask-vault-pass
Which would 

ask you for your vault password file, 
decrypt the vault file and pass the variables to the playbook;
run the docker mongodb container with your secret credentials 

All whilst ensuring your credentials are not publicly visible.
Notes

I've used this approach to provision Dockerized databases on remote managed servers in a declarative way.
You introduce one more tool, a 'wrapper' around Docker. In my experience DevOps toolchains work better than utilizing single tools. However, this may or may not be a constraint for you.


---

