Docker-compose create mongo container with username and password

Question

I have a mongo container created in Compose:

version: '2' volumes: mongodata: driver: local services: mongo: image: mongo:latest hostname: ${MONGODB_HOST} restart: always ports: - "27017:27017" volumes: - mongodata:/data/db 

This works fine, however now I want to put the password in the database. To do this, firstly, I understand that I need to create a database, add a password, and then restart it using the --auth flag. My question is how to make this process using docker-compose.

I can do this if I do everything without a docker essay. The problems that I see when creating are as follows:

a) Work in the docker is performed within the docker network. b) docker-compose cannot run different commands at the beginning, as during production. - this is important because although some people say that you can run --auth at the beginning and this will allow you to set a password for the first time, this does not seem to be the case.

One of the solutions I started working on was a shell script that I would run on all my servers before running the docker-compose file:

 # start the temporary container docker run -d -v /tmp/mongodb --name tmpdb -e MONGODB_DBNAME=db_test mongo --auth # do the user creation docker run -it --link tmpdb --rm mongo sh -c 'mongo --host tmpdb --eval "db.createUser({ user: \"admin\", pwd: \"password\", roles: [ { role: \"root\", db: \"admin\" } ] });"' # stop the server docker stop tmpdb # create new mongodb container, using the old ones data docker run -d -p 27017:27017 --name mongo2 -e MONGODB_DBNAME=db_test mongo --auth # clean up old container (we are using the volumes so they will stick around) docker rm tmpdb 

This file creates a temporary container, sets the username / password on it, stops the original container, creates a new one using the old volume container, and deletes the original one. The new mongo container now has a password.

So my final question is: what's the best way to do this in docker-compose?

My other containers in my docker file should have access to mongo, so I think the volume container containing the mongo data should be on the same network as docker-compose creates

Answer 1

Mango: the last image at the time of writing (v 3.5) accepts two environment variables, MONGO_INITDB_ROOT_USERNAME and MONGO_INITDB_ROOT_PASSWORD .

When they are installed, the script container entry point will start the mongod service using --auth, and then create the admin user with the credentials provided.

This is not currently described in their README , but there the GitHub issue tracks the progress on this, and the source is available in line 104 docker-entrypoint.sh script.

To use these variables in docker-compose.yml , see the following snippet:

 version: '3' services: mongodb: image: mongo:3.5 hostname: ${MONGODB_HOST} environment: - MONGO_INITDB_ROOT_USERNAME=alice - MONGO_INITDB_ROOT_PASSWORD=super-secret-password restart: on-failure ports: - 27017:27017 volumes: - ./mongodb:/data/db