Any way to hash POSTGRES_PASSWORD or remove env vars no longer needed after setup?

[zam6ak]

I am suspecting that POSTGRES_PASSWORD is required when creating the cluster the first time.
But then it stays there for everyone to see via docker inspect mycontainername

Even if I change the postgres user password, the original POSTGRES_PASSWORD is still there...(and now it shows wrong password)

If the environment variables are only needed for 1st time container setup, is there a way to remove them afterwards? If so should that be part of the script?

If that is not possible, is there a way to at least specify hash of the password ?

[yosifkit]

You can pass it as a file using docker secrets (#225). You can also just supply a hashed password:

If the presented password string is already in MD5-encrypted format, then it is stored encrypted as-is

- https://stackoverflow.com/a/17431573

[zam6ak]

@yosifkit Thanks for the info. This helps a lot.
Is there a way to remove vars required only for initial container setup?

[tianon]

Unfortunately, only by saving the content in a volume and recreating the container after the initial setup without the variables (which is how we usually recommend folks handle this particular case).

[zam6ak]

Thanks @tianon . Closing the issue.

[zam6ak]

@tianon

Unfortunately, only by saving the content in a volume and recreating the
container after the initial setup without the variables (which is how we
usually recommend folks handle this particular case).

I just had the opportunity to try this (using pg10 beta 3) and while the cluster starts fine, I can no longer connect to it with the same password :(

[gdraheim]

It sounds like you would actually need to edit the metadata of a docker image. In that case you could take an advantage of useing docker-copyedit.