feat: add Docker secrets support for sensitive env vars#276
Open
rafaelfariasbsb wants to merge 1 commit intoglpi-project:mainfrom
Open
feat: add Docker secrets support for sensitive env vars#276rafaelfariasbsb wants to merge 1 commit intoglpi-project:mainfrom
rafaelfariasbsb wants to merge 1 commit intoglpi-project:mainfrom
Conversation
This was referenced Feb 26, 2026
froozeify
reviewed
Feb 26, 2026
Comment on lines
+133
to
+171
| ```yaml | ||
| services: | ||
| glpi: | ||
| image: "glpi/glpi:latest" | ||
| environment: | ||
| GLPI_DB_HOST: db | ||
| GLPI_DB_PORT: 3306 | ||
| GLPI_DB_NAME: glpi | ||
| GLPI_DB_USER: glpi | ||
| GLPI_DB_PASSWORD_FILE: /run/secrets/db_password | ||
| volumes: | ||
| - glpi_data:/var/glpi | ||
| - ./db_password.txt:/run/secrets/db_password:ro | ||
| depends_on: | ||
| - db | ||
| ports: | ||
| - "80:80" | ||
| ``` | ||
|
|
||
| #### Example with Docker Swarm | ||
|
|
||
| ```yaml | ||
| services: | ||
| glpi: | ||
| image: "glpi/glpi:latest" | ||
| secrets: | ||
| - db_password | ||
| environment: | ||
| GLPI_DB_HOST: db | ||
| GLPI_DB_PORT: 3306 | ||
| GLPI_DB_NAME: glpi | ||
| GLPI_DB_USER: glpi | ||
| # No need to set GLPI_DB_PASSWORD or GLPI_DB_PASSWORD_FILE. | ||
| # The secret is automatically detected at /run/secrets/GLPI_DB_PASSWORD. | ||
|
|
||
| secrets: | ||
| db_password: | ||
| file: ./db_password.txt | ||
| ``` |
Member
There was a problem hiding this comment.
I think docker-compose could also have secrets.
So the section Example with Docker Swarm is a bit misleading,
We could propose both, and I'd say even more the swarm one should be the first proposed as it's cleaner.
In the example we could also explain various secrets possible settings like :
...
secrets:
# Various secret source is possible
db_password:
file: ./db_password.txt # From a file
# environment: DB_PWD # From an env var
# external: true # External secret
Add _FILE suffix convention and /run/secrets/ auto-detection for database credentials, following the standard pattern used by official Docker images (MySQL, MariaDB, PostgreSQL). This avoids exposing sensitive values in environment variables, docker inspect, and process listings. Closes glpi-project#194
rafaelfariasbsb
force-pushed
the
feat/docker-secrets-support
branch
from
9cb3d4d to
3aec3ea
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
_FILEsuffix convention for sensitive environment variables (GLPI_DB_PASSWORD_FILE,GLPI_DB_USER_FILE, etc.)/run/secrets/(Docker Swarm, Kubernetes, Podman)VARandVAR_FILEset) and missing filesFollows the standard pattern used by official Docker images (MySQL, MariaDB, PostgreSQL), as discussed in #194.
Changes
glpi/files/opt/glpi/entrypoint/load-secrets.shfile_env()function for secret resolutionglpi/files/opt/glpi/entrypoint.shload-secrets.shbefore other entrypoint scriptsREADME.mdResolution order
VAR_FILE— reads content from the file path specified/run/secrets/VAR— auto-detection of Docker Swarm / Kubernetes / Podman secretsVAR— standard environment variable (existing behavior, no breaking change)Test plan
_FILEvariable reads content from file and unsets_FILEvarVARandVAR_FILEare setCloses #194
🤖 Generated with Claude Code