Upgrading to Version 6.3.3+231106

The volume path for db-data was wrong.   needed data sub-folder.   Without that wasn't persisting the db on stop of container.

.github/workflows/build-latest-container-images.yaml

@@ -15,7 +15,7 @@ jobs:
           - 6.0/fpm-alpine/Dockerfile
           - 6.0/fpm/Dockerfile
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - uses: hadolint/hadolint-action@v3.1.0
         with:
           dockerfile: ${{ matrix.dockerfile }}
@@ -31,24 +31,24 @@ jobs:
       contents: read
     steps:
       - name: 'Check out the repo'
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - name: 'Set up QEMU'
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
         with:
           platforms: 'arm64,arm'
       - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
         with:
           buildkitd-flags: --debug
       - name: 'Log in to DockerHub'
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
       - name: 'Apache variant metadata'
         id: metadata-apache
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             docker.io/martialblog/limesurvey
@@ -59,7 +59,7 @@ jobs:
             latest=true
             suffix=-apache
       - name: 'Build and push latest Apache container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: 6.0/apache
           push: true
@@ -69,7 +69,7 @@ jobs:
 
       - name: 'FPM variant metadata'
         id: metadata-fpm
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             docker.io/martialblog/limesurvey
@@ -80,7 +80,7 @@ jobs:
             latest=false
             suffix=-fpm
       - name: 'Build and push latest fpm container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: 6.0/fpm
           push: true
@@ -90,7 +90,7 @@ jobs:
 
       - name: 'FPM Alpine variant metadata'
         id: metadata-fpm-alpine
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             docker.io/martialblog/limesurvey
@@ -101,7 +101,7 @@ jobs:
             latest=false
             suffix=-fpm-alpine
       - name: 'Build and push latest fpm-alpine container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: 6.0/fpm-alpine
           push: true

.github/workflows/build-lts-container-images.yaml

@@ -15,7 +15,7 @@ jobs:
           - 5.0/fpm-alpine/Dockerfile
           - 5.0/fpm/Dockerfile
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - uses: hadolint/hadolint-action@v3.1.0
         with:
           dockerfile: ${{ matrix.dockerfile }}
@@ -31,24 +31,24 @@ jobs:
       contents: read
     steps:
       - name: 'Check out the repo'
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - name: 'Set up QEMU'
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
         with:
           platforms: 'arm64,arm'
       - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
         with:
           buildkitd-flags: --debug
       - name: 'Log in to DockerHub'
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
       - name: 'Apache variant metadata'
         id: metadata-apache
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             docker.io/martialblog/limesurvey
@@ -59,7 +59,7 @@ jobs:
             latest=false
             suffix=-apache
       - name: 'Build and push LTS apache container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: 5.0/apache
           push: true
@@ -69,7 +69,7 @@ jobs:
 
       - name: 'FPM variant metadata'
         id: metadata-fpm
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             docker.io/martialblog/limesurvey
@@ -80,7 +80,7 @@ jobs:
             latest=false
             suffix=-fpm
       - name: 'Build and push LTS fpm container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: 5.0/fpm
           push: true
@@ -90,7 +90,7 @@ jobs:
 
       - name: 'FPM Alpine variant metadata'
         id: metadata-fpm-alpine
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             docker.io/martialblog/limesurvey
@@ -101,7 +101,7 @@ jobs:
             latest=false
             suffix=-fpm-alpine
       - name: 'Build and push LTS fpm-alpine container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: 5.0/fpm-alpine
           push: true

.github/workflows/lint-dockerfiles.yaml

@@ -17,7 +17,7 @@ jobs:
           - 6.0/fpm/Dockerfile
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - uses: hadolint/hadolint-action@v3.1.0
         with:
           dockerfile: ${{ matrix.dockerfile }}

.github/workflows/test-arm-container-images.yaml

@@ -22,18 +22,18 @@ jobs:
           - linux/arm64
     steps:
       - name: 'Check out the repo'
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: 'Set up QEMU'
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
         with:
           platforms: 'arm64,arm'
 
       - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: 'Build Container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: 6.0/${{ matrix.context }}
           push: false

.github/workflows/test-latest-container-images.yaml

@@ -14,18 +14,18 @@ jobs:
           - fpm
     steps:
       - name: 'Check out the repo'
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: 'Set up QEMU'
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
         with:
           platforms: 'arm64,arm'
 
       - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: 'Build Container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: 6.0/${{ matrix.context }}
           push: false

.github/workflows/test-lts-container-images.yaml

@@ -14,16 +14,16 @@ jobs:
           - fpm
     steps:
       - name: 'Check out the repo'
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: 'Set up QEMU'
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
 
       - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: 'Build Container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: 5.0/${{ matrix.context }}
           push: false

5.0/apache/Dockerfile

@@ -5,7 +5,9 @@ LABEL maintainer="markus@martialblog.de"
 RUN set -ex; \
         apt-get update; \
         apt-get install -y --no-install-recommends \
-                netcat \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
         ; \
         \
         apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
@@ -79,9 +81,9 @@ RUN a2enmod headers rewrite remoteip; \
 # Use the default production configuration
 RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
 
-ARG version="5.6.25+230605"
+ARG version="5.6.43+231030"
-ARG sha256_checksum="283d17ce1b230c584a2b86813d181df2d471e977e74d33da8bb7eb9adcdbd228"
+ARG sha256_checksum="4eedef15202ac771e08cb64a4c8e4083026da6ac1642f9a1ba952f8917e321f0"
-ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
 ARG USER=www-data
 ARG LISTEN_PORT=8080
 ENV LIMESURVEY_VERSION=$version

5.0/apache/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
+file_env 'ENCRYPT_KEYPAIR'
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
+file_env 'ENCRYPT_PUBLIC_KEY'
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_SECRET_KEY'
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
+file_env 'ENCRYPT_NONCE'
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -35,12 +52,12 @@ DEBUG_SQL=${DEBUG_SQL:-0}
 LISTEN_PORT=${LISTEN_PORT:-"8080"}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 
@@ -136,7 +153,7 @@ if [ -f application/config/security.php ]; then
     echo 'Info: security.php already provisioned'
 else
     echo 'Info: Creating security.php'
-    if [ -n "$ENCRYPT_KEYPAIR" ]; then
+    if [ -n "$ENCRYPT_KEYPAIR" ] || [ -n "$ENCRYPT_SECRET_BOX_KEY" ]; then
 
         cat <<EOF > application/config/security.php
 <?php if (!defined('BASEPATH')) exit('No direct script access allowed');

5.0/fpm-alpine/Dockerfile

@@ -2,7 +2,12 @@ FROM docker.io/php:8.0-fpm-alpine
 LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
-RUN apk add --no-cache netcat-openbsd bash
+RUN set -ex; \
+        apk add --no-cache \
+        netcat-openbsd \
+        libsasl \
+        libldap \
+        bash
 
 # Install PHP Plugins
 # hadolint ignore=SC2086
@@ -46,9 +51,9 @@ RUN set -ex; \
     apk add --no-cache --no-network --virtual .limesurvey-phpext-rundeps $runDeps; \
     apk del --no-cache --no-network .build-deps
 
-ARG version="5.6.25+230605"
+ARG version="5.6.43+231030"
-ARG sha256_checksum="283d17ce1b230c584a2b86813d181df2d471e977e74d33da8bb7eb9adcdbd228"
+ARG sha256_checksum="4eedef15202ac771e08cb64a4c8e4083026da6ac1642f9a1ba952f8917e321f0"
-ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
 ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version
 

5.0/fpm-alpine/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
+file_env 'ENCRYPT_KEYPAIR'
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
+file_env 'ENCRYPT_PUBLIC_KEY'
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_SECRET_KEY'
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
+file_env 'ENCRYPT_NONCE'
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 
@@ -129,7 +146,7 @@ if [ -f application/config/security.php ]; then
     echo 'Info: security.php already provisioned'
 else
     echo 'Info: Creating security.php'
-    if [ -n "$ENCRYPT_KEYPAIR" ]; then
+    if [ -n "$ENCRYPT_KEYPAIR" ] || [ -n "$ENCRYPT_SECRET_BOX_KEY" ]; then
 
         cat <<EOF > application/config/security.php
 <?php if (!defined('BASEPATH')) exit('No direct script access allowed');

5.0/fpm/Dockerfile

@@ -5,7 +5,9 @@ LABEL maintainer="markus@martialblog.de"
 RUN set -ex; \
         apt-get update; \
         apt-get install -y --no-install-recommends \
-                netcat \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
         ; \
         \
         apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
@@ -66,9 +68,9 @@ RUN set -ex; \
         apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
         rm -rf /var/lib/apt/lists/*
 
-ARG version="5.6.25+230605"
+ARG version="5.6.43+231030"
-ARG sha256_checksum="283d17ce1b230c584a2b86813d181df2d471e977e74d33da8bb7eb9adcdbd228"
+ARG sha256_checksum="4eedef15202ac771e08cb64a4c8e4083026da6ac1642f9a1ba952f8917e321f0"
-ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
 ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version
 

5.0/fpm/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
+file_env 'ENCRYPT_KEYPAIR'
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
+file_env 'ENCRYPT_PUBLIC_KEY'
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_SECRET_KEY'
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
+file_env 'ENCRYPT_NONCE'
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 
@@ -129,7 +146,7 @@ if [ -f application/config/security.php ]; then
     echo 'Info: security.php already provisioned'
 else
     echo 'Info: Creating security.php'
-    if [ -n "$ENCRYPT_KEYPAIR" ]; then
+    if [ -n "$ENCRYPT_KEYPAIR" ] || [ -n "$ENCRYPT_SECRET_BOX_KEY" ]; then
 
         cat <<EOF > application/config/security.php
 <?php if (!defined('BASEPATH')) exit('No direct script access allowed');

6.0/apache/Dockerfile

@@ -1,11 +1,13 @@
-FROM docker.io/php:8.1-apache
+FROM docker.io/php:8.0-apache
 LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
 RUN set -ex; \
         apt-get update; \
         apt-get install -y --no-install-recommends \
-                netcat \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
         ; \
         \
         apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
@@ -79,9 +81,9 @@ RUN a2enmod headers rewrite remoteip; \
 # Use the default production configuration
 RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
 
-ARG version="6.1.2+230606"
+ARG version="6.3.3+231106"
-ARG sha256_checksum="5d92b793b98ad697ec65aa3bb615c49158b7578860ba7d352fe0102938daa37c"
+ARG sha256_checksum="5cec4e2ae2f03abafa3ebf5ef7b43b2d007ca30639a48ccea84e7d8f20441348"
-ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
 ARG USER=www-data
 ARG LISTEN_PORT=8080
 ENV LIMESURVEY_VERSION=$version

6.0/apache/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
+file_env 'ENCRYPT_KEYPAIR'
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
+file_env 'ENCRYPT_PUBLIC_KEY'
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_SECRET_KEY'
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
+file_env 'ENCRYPT_NONCE'
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -35,12 +52,12 @@ DEBUG_SQL=${DEBUG_SQL:-0}
 LISTEN_PORT=${LISTEN_PORT:-"8080"}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 
@@ -136,7 +153,7 @@ if [ -f application/config/security.php ]; then
     echo 'Info: security.php already provisioned'
 else
     echo 'Info: Creating security.php'
-    if [ -n "$ENCRYPT_KEYPAIR" ]; then
+    if [ -n "$ENCRYPT_KEYPAIR" ] || [ -n "$ENCRYPT_SECRET_BOX_KEY" ]; then
 
         cat <<EOF > application/config/security.php
 <?php if (!defined('BASEPATH')) exit('No direct script access allowed');

6.0/fpm-alpine/Dockerfile

@@ -1,8 +1,13 @@
-FROM docker.io/php:8.1-fpm-alpine
+FROM docker.io/php:8.0-fpm-alpine
 LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
-RUN apk add --no-cache netcat-openbsd bash
+RUN set -ex; \
+        apk add --no-cache \
+        netcat-openbsd \
+        libsasl \
+        libldap \
+        bash
 
 # Install PHP Plugins
 # hadolint ignore=SC2086
@@ -46,9 +51,9 @@ RUN set -ex; \
     apk add --no-cache --no-network --virtual .limesurvey-phpext-rundeps $runDeps; \
     apk del --no-cache --no-network .build-deps
 
-ARG version="6.1.2+230606"
+ARG version="6.3.3+231106"
-ARG sha256_checksum="5d92b793b98ad697ec65aa3bb615c49158b7578860ba7d352fe0102938daa37c"
+ARG sha256_checksum="5cec4e2ae2f03abafa3ebf5ef7b43b2d007ca30639a48ccea84e7d8f20441348"
-ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
 ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version
 

6.0/fpm-alpine/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
+file_env 'ENCRYPT_KEYPAIR'
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
+file_env 'ENCRYPT_PUBLIC_KEY'
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_SECRET_KEY'
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
+file_env 'ENCRYPT_NONCE'
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 
@@ -129,7 +146,7 @@ if [ -f application/config/security.php ]; then
     echo 'Info: security.php already provisioned'
 else
     echo 'Info: Creating security.php'
-    if [ -n "$ENCRYPT_KEYPAIR" ]; then
+    if [ -n "$ENCRYPT_KEYPAIR" ] || [ -n "$ENCRYPT_SECRET_BOX_KEY" ]; then
 
         cat <<EOF > application/config/security.php
 <?php if (!defined('BASEPATH')) exit('No direct script access allowed');

6.0/fpm/Dockerfile

@@ -1,11 +1,13 @@
-FROM docker.io/php:8.1-fpm
+FROM docker.io/php:8.0-fpm
 LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
 RUN set -ex; \
         apt-get update; \
         apt-get install -y --no-install-recommends \
-                netcat \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
         ; \
         \
         apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
@@ -66,9 +68,9 @@ RUN set -ex; \
         apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
         rm -rf /var/lib/apt/lists/*
 
-ARG version="6.1.2+230606"
+ARG version="6.3.3+231106"
-ARG sha256_checksum="5d92b793b98ad697ec65aa3bb615c49158b7578860ba7d352fe0102938daa37c"
+ARG sha256_checksum="5cec4e2ae2f03abafa3ebf5ef7b43b2d007ca30639a48ccea84e7d8f20441348"
-ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
 ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version
 

6.0/fpm/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
+file_env 'ENCRYPT_KEYPAIR'
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
+file_env 'ENCRYPT_PUBLIC_KEY'
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_SECRET_KEY'
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
+file_env 'ENCRYPT_NONCE'
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 
@@ -129,7 +146,7 @@ if [ -f application/config/security.php ]; then
     echo 'Info: security.php already provisioned'
 else
     echo 'Info: Creating security.php'
-    if [ -n "$ENCRYPT_KEYPAIR" ]; then
+    if [ -n "$ENCRYPT_KEYPAIR" ] || [ -n "$ENCRYPT_SECRET_BOX_KEY" ]; then
 
         cat <<EOF > application/config/security.php
 <?php if (!defined('BASEPATH')) exit('No direct script access allowed');

README.md

@@ -115,10 +115,10 @@ If you are running LimeSurvey behind a Reverse Proxy you might need some additio
 | DB_MYSQL_ENGINE | MySQL engine used for survey tables (values: MyISAM, InnoDB, default: MyISAM)       |
 | DB_USERNAME     | Database user                             |
 | DB_PASSWORD     | Database user's password                  |
-| ADMIN_USER      | Initial LimeSurvey Admin User             |
+| ADMIN_USER      | Initial LimeSurvey Admin Username (for signing into admin panel)             |
-| ADMIN_NAME      | Initial LimeSurvey Admin Username         |
+| ADMIN_NAME      | Initial LimeSurvey Admin Name             |
 | ADMIN_EMAIL     | Initial LimeSurvey Admin Email            |
-| ADMIN_PASSWORD  | Initial LimeSurvey Admin Password         |
+| ADMIN_PASSWORD  | Initial LimeSurvey Admin Password (for signing into admin panel)         |
 | PUBLIC_URL      | Public URL for public scripts             |
 | BASE_URL        | Application Base URL                      |
 | URL_FORMAT      | URL Format. path or get                   |
@@ -133,12 +133,26 @@ If you are running LimeSurvey behind a Reverse Proxy you might need some additio
 | ENCRYPT_SECRET_BOX_KEY | Data encryption secret box key (used in 5.0 and higher) |
 | LISTEN_PORT     | Apache: Listen port. Default: 8080        |
 
+Sensitive information can also be passed `_FILE` to the following environment variables to load the values from the given file path. Example `DB_PASSWORD_FILE=/run/secrets/db_password`.
+
+```
+DB_PASSWORD_FILE
+ADMIN_PASSWORD_FILE
+ENCRYPT_KEYPAIR_FILE
+ENCRYPT_PUBLIC_KEY_FILE
+ENCRYPT_SECRET_KEY_FILE
+ENCRYPT_NONCE_FILE
+ENCRYPT_SECRET_BOX_KEY_FILE
+```
+
 For further details on the settings see: https://manual.limesurvey.org/Optional_settings#Advanced_Path_Settings
 
 # Running LimeSurvey with docker-compose
 
 The easiest way to get a fully featured and functional setup is using a docker-compose file. Several examples are provided in the [repository](https://github.com/martialblog/docker-limesurvey).
 
+**Hint:** You need to configure a database and Limesurvey password in the `docker-compose` files before starting. No defaults are provided to discourage production use with default passwords.
+
 ```
 docker-compose up
 

docker-compose.apache.yml

@@ -8,8 +8,8 @@ services:
       - lime-db
     environment:
       - "DB_HOST=lime-db"
-      - "DB_PASSWORD=secret"
+      # - "DB_PASSWORD="
-      - "ADMIN_PASSWORD=foobar"
+      # - "ADMIN_PASSWORD="
       - "PUBLIC_URL=http://my.survey.localhost:8080"  # Example, Change this
       - "BASE_URL=http://my.survey.localhost:8080"  # Example, Change this
   proxy:
@@ -24,6 +24,6 @@ services:
     environment:
       - "MYSQL_USER=limesurvey"
       - "MYSQL_DATABASE=limesurvey"
-      - "MYSQL_PASSWORD=secret"
+      # - "MYSQL_PASSWORD="
-      - "MYSQL_ROOT_PASSWORD=secret"
+      # - "MYSQL_ROOT_PASSWORD="
 

docker-compose.example.yml

@@ -7,12 +7,12 @@ services:
       - DB_TYPE=pgsql
       - DB_PORT=5432
       - DB_HOST=db
-      - DB_PASSWORD=example
+      # - DB_PASSWORD=
       - DB_NAME=limesurvey
       - DB_USERNAME=limesurvey
       - ADMIN_USER=admin
       - ADMIN_NAME=Admin
-      - ADMIN_PASSWORD=example
+      # - ADMIN_PASSWORD=
       - ADMIN_EMAIL=admin@example.com
       - PUBLIC_URL=foobar.com
     volumes:
@@ -25,11 +25,11 @@ services:
     image: docker.io/postgres:10-alpine
     restart: always
     volumes:
-      - db-data:/var/lib/postgresql
+      - db-data:/var/lib/postgresql/data
     environment:
       - POSTGRES_USER=limesurvey
       - POSTGRES_DB=limesurvey
-      - POSTGRES_PASSWORD=example
+      # - POSTGRES_PASSWORD=
 
 volumes:
   limesurvey:

docker-compose.fpm-certbot.yml

@@ -14,8 +14,8 @@ services:
       - lime-db
     environment:
       - "DB_HOST=lime-db"
-      - "DB_PASSWORD=secret"
+      # - "DB_PASSWORD="
-      - "ADMIN_PASSWORD=foobar"
+      # - "ADMIN_PASSWORD="
    lime-web:
     build:
       context: nginx-certbot/
@@ -44,7 +44,7 @@ services:
     environment:
       - "MYSQL_USER=limesurvey"
       - "MYSQL_DATABASE=limesurvey"
-      - "MYSQL_PASSWORD=secret"
+      # - "MYSQL_PASSWORD="
-      - "MYSQL_ROOT_PASSWORD=secret"
+      # - "MYSQL_ROOT_PASSWORD="
 volumes:
   lime:

docker-compose.fpm.alpine.yml

@@ -14,8 +14,8 @@ services:
       - lime-db
     environment:
       - "DB_HOST=lime-db"
-      - "DB_PASSWORD=secret"
+      # - "DB_PASSWORD="
-      - "ADMIN_PASSWORD=foobar"
+      # - "ADMIN_PASSWORD="
   lime-web:
     image: docker.io/nginx:alpine
     links:
@@ -32,7 +32,7 @@ services:
     environment:
       - "MYSQL_USER=limesurvey"
       - "MYSQL_DATABASE=limesurvey"
-      - "MYSQL_PASSWORD=secret"
+      # - "MYSQL_PASSWORD="
-      - "MYSQL_ROOT_PASSWORD=secret"
+      # - "MYSQL_ROOT_PASSWORD="
 volumes:
   lime:

docker-compose.fpm.yml

@@ -14,8 +14,8 @@ services:
       - lime-db
     environment:
       - "DB_HOST=lime-db"
-      - "DB_PASSWORD=secret"
+      # - "DB_PASSWORD="
-      - "ADMIN_PASSWORD=foobar"
+      # - "ADMIN_PASSWORD="
   lime-web:
     image: docker.io/nginx
     links:
@@ -30,7 +30,7 @@ services:
     environment:
       - "MYSQL_USER=limesurvey"
       - "MYSQL_DATABASE=limesurvey"
-      - "MYSQL_PASSWORD=secret"
+      # - "MYSQL_PASSWORD="
-      - "MYSQL_ROOT_PASSWORD=secret"
+      # - "MYSQL_ROOT_PASSWORD="
 volumes:
   lime:

docker-compose.pgsql.yml

@@ -19,8 +19,8 @@ services:
       - "DB_TYPE=pgsql"
       - "DB_PORT=5432"
       - "DB_HOST=lime-db"
-      - "DB_PASSWORD=secret"
+      # - "DB_PASSWORD="
-      - "ADMIN_PASSWORD=foobar"
+      # - "ADMIN_PASSWORD="
   lime-db:
     image: docker.io/postgres:10
     volumes:
@@ -28,7 +28,7 @@ services:
     environment:
       - "POSTGRES_USER=limesurvey"
       - "POSTGRES_DB=limesurvey"
-      - "POSTGRES_PASSWORD=secret"
+      # - "POSTGRES_PASSWORD="
 
 volumes:
   db-data:

docker-compose.traefik.domain.yml

@@ -15,8 +15,8 @@ services:
       - lime-db
     environment:
       - "DB_HOST=lime-db"
-      - "DB_PASSWORD=secret"
+      # - "DB_PASSWORD="
-      - "ADMIN_PASSWORD=foobar"
+      # - "ADMIN_PASSWORD="
       - "PUBLIC_URL=http://my.survey.localhost:8888"
       - "BASE_URL=http://my.survey.localhost:8888"
   traefik:
@@ -37,6 +37,5 @@ services:
     environment:
       - "MYSQL_USER=limesurvey"
       - "MYSQL_DATABASE=limesurvey"
-      - "MYSQL_PASSWORD=secret"
+      # - "MYSQL_PASSWORD="
-      - "MYSQL_ROOT_PASSWORD=secret"
+      # - "MYSQL_ROOT_PASSWORD="
-

docker-compose.traefik.yml

@@ -19,8 +19,8 @@ services:
       - "./examples/apache-example.conf:/etc/apache2/sites-available/000-default.conf:ro"
     environment:
       - "DB_HOST=lime-db"
-      - "DB_PASSWORD=secret"
+      # - "DB_PASSWORD="
-      - "ADMIN_PASSWORD=foobar"
+      # - "ADMIN_PASSWORD="
       - "PUBLIC_URL=http://localhost:8888/limesurvey"
       - "BASE_URL=http://localhost:8888/limesurvey"
   traefik:
@@ -41,6 +41,5 @@ services:
     environment:
       - "MYSQL_USER=limesurvey"
       - "MYSQL_DATABASE=limesurvey"
-      - "MYSQL_PASSWORD=secret"
+      # - "MYSQL_PASSWORD="
-      - "MYSQL_ROOT_PASSWORD=secret"
+      # - "MYSQL_ROOT_PASSWORD="
-

docker-compose.yml

@@ -15,8 +15,8 @@ services:
       - "8080:8080"
     environment:
       - "DB_HOST=lime-db"
-      - "DB_PASSWORD=secret"
+      # - "DB_PASSWORD="
-      - "ADMIN_PASSWORD=foobar"
+      # - "ADMIN_PASSWORD="
       # If you require an empty table prefix, use a space as the DB_TABLE_PREFIX
       # - "DB_TABLE_PREFIX= "
   lime-db:
@@ -24,5 +24,5 @@ services:
     environment:
       - "MYSQL_USER=limesurvey"
       - "MYSQL_DATABASE=limesurvey"
-      - "MYSQL_PASSWORD=secret"
+      # - "MYSQL_PASSWORD="
-      - "MYSQL_ROOT_PASSWORD=secret"
+      # - "MYSQL_ROOT_PASSWORD="