Skip to content

Add Docker Secret support #248

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
abelfodil wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add Docker Secret support #248

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ jobs:
- "sqlite"
- "mariadb"
- "postgresql"
- "postgresql-secret"

steps:
- name: "Checkout"
Expand Down
2 changes: 2 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,8 @@ Default login is `wallabag:wallabag`.
- `-e SYMFONY__ENV__SERVER_NAME=...` (defaults to "Your wallabag instance". Specifies a user-friendly name for the 2FA issuer)
- `-e PHP_MEMORY_LIMIT=...` (allows you to change the PHP `memory_limit` value. defaults to 128M, and should be a number and unit, eg. 512K, 128M, 2G, or a number of bytes)

To set any of these environment variables from a file (for instance a Docker Secret), append `__FILE` to the name of the environment variable.

## SQLite

The easiest way to start wallabag is to use the SQLite backend. You can spin that up with
Expand Down
10 changes: 10 additions & 0 deletions root/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,16 @@
# Exit when any command fails
set -e

FILE_ENV_VARS="$(env | grep '__FILE=')"
for env_var in $FILE_ENV_VARS; do
var_name="$(echo "$env_var" | grep -o '.*__FILE=' | sed 's/__FILE=//g')"
file_path="$(echo "$env_var" | grep -o '__FILE=.*' | sed 's/__FILE=//g')"
file_content="$(cat "$file_path")"
[ ! $? -eq 0 ] && exit 1 # Exit if last command failed
new_var="$(echo "$var_name=$file_content")"
export $(echo "$new_var" | xargs)
done
Copy link

@jbrobst jbrobst Sep 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing some quoting here and [[ is bash-specific. This is sh, so maybe replace this whole block with something like:

for n in $(LC_ALL=C awk 'BEGIN {for (n in ENVIRON) if (n ~ /^[0-9A-Z_]+__FILE$/) print n}'); do
	if ! eval "${n%__FILE}=\$(cat -- \"\$$n\") && export ${n%__FILE}"; then
		printf 'Failed to read $%s\n' "$n" >&2
		exit 1
	fi
done


COMMAND_ARG1="$1"
COMMAND_ARG2="$2"

Expand Down
1 change: 1 addition & 0 deletions tests/credentials/db_password
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
wallapass
1 change: 1 addition & 0 deletions tests/credentials/env_secret
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
F00B4R
1 change: 1 addition & 0 deletions tests/credentials/postgres_password
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
my-secret-pw
31 changes: 31 additions & 0 deletions tests/docker-compose.postgresql-secret.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
version: '2'
services:
wallabag:
build:
context: ../
image: wallabag:postgresql
container_name: wallabag
environment:
- POSTGRES_PASSWORD__FILE=/run/secrets/postgres_password
- POSTGRES_USER=my-super-user
- SYMFONY__ENV__SECRET__FILE=/run/secrets/env_secret
- SYMFONY__ENV__DATABASE_DRIVER=pdo_pgsql
- SYMFONY__ENV__DATABASE_HOST=db
- SYMFONY__ENV__DATABASE_PORT=5432
- SYMFONY__ENV__DATABASE_NAME=wallabag
- SYMFONY__ENV__DATABASE_USER=wallabag
- SYMFONY__ENV__DATABASE_PASSWORD__FILE=/run/secrets/db_password
ports:
- "127.0.0.1:80:80"
# Docker Secrets require Swarm Mode, so we use volumes instead to spoof the behaviour
volumes:
- ./credentials/db_password:/run/secrets/db_password
- ./credentials/postgres_password:/run/secrets/postgres_password
- ./credentials/env_secret:/run/secrets/env_secret
db:
image: postgres:18
environment:
- POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
- POSTGRES_USER=my-super-user
volumes:
- ./credentials/postgres_password:/run/secrets/postgres_password
Loading