Docker-sonarqube: Support for docker secrets

[dotslashme]

Not sure if this is already supported, but I would love to have support for docker secrets in Sonarqube. Having to specify the database user/password directly in my compose file, prevents me from using versioning software.

[simonbrandhof]

I may be wrong but Docker secrets are supported by the swarm mode only, so they are out of the scope of this image. The best alternative is that you build your own image.

[dotslashme]

Secrets are supported both my Docker compose and Docker swarm, but afaik compose only supports internal secrets. However, a mechanism to support docker secrets is not hard to implement and it only requires fetching the value from a file mounted under /run/secrets/ and then exposing it like an environmental variable like so:
=

I do it myself with a small bash script like this:

#!/usr/bin/env bash

pass=$(cat /run/secrets/sonar-db-password)
export SONARQUBE_JDBC_PASSWORD="$pass"

exec "$@"

However, it would be nice if I didn't have to extend the image myself, but rather the entrypoint of the image could take an argument that would read such a file instead.

[bishtawi]

I would like to see this too. I pass secrets in Docker Compose using the Docker secrets functionality all the time and I would rather not customize the Sonarqube Docker image myself.

[damianb]

This is pretty disappointing to see open still.

The inability to consume docker secrets results in docker-compose files using docker sonarqube to be unable to be properly version controlled, which is fairly comical considering what kind of tool sonarqube is.

Just like @dotslashme mentioned, it's fairly easy to implement and should not require extending the image.

EDIT: To clarify, this requires having secrets put inside of complex infrastructure configuration, which then prevents said configuration from being version controlled. Take a moment to think about whether YOU would want a developer hardcoding passwords into an application; this is no different.

On top of that, postgres and mariadb's docker images both exist as clear examples as to how it can be implemented properly.

[michal-duda-sonarsource]

Versioning docker-compose files is still possible with the current image. Instead of passing the environment variables you can mount the conf directory which contains full SQ configuration in sonar.properties file.

[dotslashme]

Versioning docker-compose files is still possible with the current image. Instead of passing the environment variables you can mount the conf directory which contains full SQ configuration in sonar.properties file.

Yes, but then where do I store the config files? The whole point of the ticket is to be able to have all my configs in versioning software and keep secrets specifically out of it.

[nixel2007]

ansible vault?

[johnqa]

are there any updates on this? I saw there is a pull request on this but I don't think is integrated in any version.

[khooz]

Please consider both docker configs and docker secrets as these will help creating cleaner compose files AND images.

Docker swarm service configs allow you to store non-sensitive information, such as configuration files, outside a service’s image or running containers. This allows you to keep your images as generic as possible, without the need to bind-mount configuration files into the containers or use environment variables.
_ Store configuration data using Docker Configs

You can use secrets to manage any sensitive data which a container needs at runtime but you don’t want to store in the image or in source control
_ Manage sensitive data with Docker secrets

[rprodan]

Sonarqube team is there any reflection or progress on this topic?