Environment variables (set with
-e) in Docker containers are available to every linked container.
Consider a typical use case, a database. The official MySQL image gives this example command:
docker run --name some-mysql -e MYSQL_ROOT_PASSWORD=my-secret-pw -d mysql:tag
I have just put my password as plaintext inside an environment variable. To be sure, you need to
docker inspect to see it, and if you can do that, that means you have root access to the host OS, which is game over anyhow... So let's move on.
Now I want to set up a wiki as well. Let's use this MediaWiki image. We also need to link the database:
docker run --name some-mediawiki --link some-mysql:mysql -d synctree/mediawiki
Oops! When I linked
some-mysql, the environment variables propagated and now
some-mediawiki can see
MYSQL_ROOT_PASSWORD as well! This means that if someone were to compromise the wiki, they can potentially also find out the root password, and then get into the database with it through the link.
There has been some discussion by Docker devs about this, and the conclusion is that environment variables were never meant for sharing secrets securely anyway, and it is a mistake to use them in this way. Yet all the time I see images passing the password as an environment variable, even many official database images do this. Why?