docker-mediawiki icon indicating copy to clipboard operation
docker-mediawiki copied to clipboard

MEDIAWIKI_DB_PASSWORD required every run

Open rbong opened this issue 7 years ago • 0 comments

MEDIAWIKI_DB_PASSWORD is required everytime the image is run, even though it is only required on install. This makes the image less secure by requiring the password to be stored both inside the image and in environment variables, requiring the password to be stored outside of the image, giving two vectors of attack to access the secret.

This is because MEDIAWIKI_DB_TYPE defaults to mysql, set -e is run, and php runs exit(1) if it fails to connect.

A workaround is to set MEDIAWIKI_DB_TYPE to something else. I'd like to make a pull request to either give this workaround in the README, or to not attempt to connect if the password is empty in the entrypoint.

However, is this design intentional?

rbong avatar May 01 '17 15:05 rbong