i have my local docker CLI binary connected with a docker daemon on the LAN (or better say on the same machine). for certain duties this daemon needs to connect to the internet via a company firewall/proxy system. (the system is based upon Ubuntu 16.04 LTS - the issue might be relevant for a lot more similar systems.)
the daemon is configured similar to this snippet from Ultimate Guide to Docker HTTP Proxy Configuration as shown in case #2 for the file /etc/systemd/system/docker.service.d/http-proxy.conf:
[Service]
Environment="HTTP_PROXY=http://your.proxy:8080"
Environment="HTTPS_PROXY=http://your.proxy:8080"
Environment="NO_PROXY=127.0.0.1,localhost"
for this config to finally work i have to add (with sudo rights elevation) "username:password@" upfront the "your.proxy" part of the server name.
then i am operating/restarting the systemd and daemon:
sudo systemctl daemon-reload
sudo systemctl restart docker
finally i am checking (as a simple user) the result:
systemctl show --property=Environment docker
It results in something like this (the environment items seemingly listed in a space separated fashion):
Environment=HTTP_PROXY=http://username:[email protected]:8080 HTTPS_PROXY=http://username:[email protected]:8080 NO_PROXY=127.0.0.1,localhost
As you can see this simple user command unveils the proxy credentials. I definitely dont want that to be.
How can i prevent any ordinary user from retriving these set of proxy credentials? Is there a method that copes with the systemd environment concept? or is some alternate method needed, if yes, which one?