docker-compose secrets MYSQL_ROOT_PASSWORD_FILE work correctly but DB_PASSWORD result empty string

MYSQL_ROOT_PASSWORD_FILE work correctly but DB_PASSWORD result empty string

In my project. I use react as frontend, golang with fiber framework as backend and mysql as database.

It work fine when I set ENV in Dockerfile. but when I work with docker-compose secrets. In database container work correctly but in backend container. The environment variable result empty string,

dockercompose.yml

version: '2.17.3'
backend:
container_name: app-backend
image: app-backend:private
build: 
context: ./server/.
dockerfile: Dockerfile.private
secrets:
- db_password
- db_name
- jwt_secret_key
- mailer_password
- mailer_username
environment:
- DB_HOST=my-database
- DB_PORT=3306
- DB_USER=root
- DB_PASSWORD_FILE=/run/secrets/db_password
- DB_NAME_FILE=/run/secrets/db_name
# Leave SERVER_HOST BLANK. Info: https://stackoverflow.com/a/61047889
- SERVER_HOST=
- SERVER_PORT=8080
- WEBSITE_HOST=localhost:3000
- JWT_SECRET_KEY_FILE=/run/secrets/jwt_secret_key
- MAILER_HOST=smtp.gmail.com
- MAILER_PORT=587
- MAILER_USERNAME_FILE=/run/secrets/mailer_username
- MAILER_PASSWORD_FILE=/run/secrets/mailer_password
- ALLOW_ORIGINS=http://localhost:3000
ports:
- 8000:8080
user: nonroot:nonroot
networks:
- my-network
database:
container_name: app-database
image: mysql
build:
dockerfile: ./server/Dockerfile.database
secrets:
- db_root_password
environment:
- MYSQL_ROOT_PASSWORD_FILE=/run/secrets/db_root_password
ports:
- 3307:3306
command: --default-authentication-plugin=mysql_native_password
restart: unless-stopped
networks:
- my-network
networks:
my-network:
secrets:
db_root_password:
file: ./secrets/db_root_password.txt
db_password:
file: ./secrets/db_password.txt
db_name:
file: ./secrets/db_name.txt
jwt_secret_key: 
file: ./secrets/jwt_secret_key.txt
mailer_password:
file: ./secrets/mailer_password.txt
mailer_username:
file: ./secrets/mailer_username.txt

Dockerfile.private

# syntax=docker/dockerfile:1
##
## Build the application from source
##
FROM golang:1.20.4-bullseye AS build-stage
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download && go mod verify
COPY . ./
RUN CGO_ENABLED=0 GOOS=linux go build -o main main.go
##
## Deploy the application binary into a lean image
##
FROM gcr.io/distroless/base-debian11 AS build-release-stage
WORKDIR /app
COPY --from=build-stage /app/main .
EXPOSE 8080
USER nonroot:nonroot
ENTRYPOINT ["/app/main"]

Dockerfile.database

# database
FROM mysql
EXPOSE 3306
CMD ["--default-authentication-plugin=mysql_native_password"]

build script

docker-compose up -d --build

I've check MYSQL_ROOT_PASSWORD_FILE=/run/secrets/db_root_password in mysql database. It work correctly. I can connect to database. but in backend. In docker-desktop logs show it have empty string

 ┌───────────────────────────────────────────────────┐ 
│                   Fiber v2.45.0                   │ 
│               http://127.0.0.1:8080               │ 
│       (bound on host 0.0.0.0 and port 8080)       │ 
│                                                   │ 
│ Handlers ............ 49  Processes ........... 1 │ 
│ Prefork ....... Disabled  PID ................. 1 │ 
└───────────────────────────────────────────────────┘ 
2023/05/22 22:21:30 Try connecting to database: %w root:@tcp(nf-theater-database:3306)/?parseTime=true

Here my golang connection code

package database
import (
"database/sql"
"fmt"
"log"
"os"
)
func Connect() *sql.DB {
dbUser := os.Getenv("DB_USER")
dbPassword := os.Getenv("DB_PASSWORD")
dbHost := os.Getenv("DB_HOST")
dbPort := os.Getenv("DB_PORT")
dbName := os.Getenv("DB_NAME")
connString := fmt.Sprintf("%s:%s@tcp(%s:%s)/%s?parseTime=true", dbUser, dbPassword, dbHost, dbPort, dbName)
log.Println("Try connecting to database: %w", connString)
// Open database connection
db, err := sql.Open("mysql", connString)
if err != nil {
fmt.Println(err.Error())
}
return db
}

I've try to change version in first line of docker-compose from version: '2.17.3' to version: '3.8' but result was the same

I don't understand why it's don't work. I don't want to switch to swarm if it don't have to. How can I fix this?

The MYSQL docker-entrypoint.sh checks for the environment variable MYSQL_ROOT_PASSWORD_FILE and, if present, loads the contents of the file named in the variable into the environmental variable MYSQL_ROOT_PASSWORD (which is then used elsewhere in the script as the password).

So there is no special handling of variables ending with _FILE; something in the container needs to check for the variable and load the data from the file.

Your docker-compose.yml sets the variable DB_PASSWORD_FILE and runs your application directly (ENTRYPOINT ["/app/main"]). You then attempt to read DB_PASSWORD (dbPassword := os.Getenv("DB_PASSWORD")); this will be empty because you have not set that environmental variable.

You could add a script, similar to that used in the MYSQL container, or just read the variable as set e.g.

dbPasswordFile := os.Getenv("DB_PASSWORD_FILE")
dbPassword, err := os.ReadFile(dbPasswordFile)

Note: You should probably check for a blank variable and handle any errors