2

In our project we are using Docker and we have multiple services with a pile of environmental variables (mostly credentials to various dbs, mail, samba, 30+ entries in total). It all worked well with docker_compose.yml and docker-compose up -d --build. The advantage of this method was an extensive usage of env files. For example, I had mupltiple env files and I could use them in docker-compose.yml:

env_file:
  - ./envs/common.env
  - ./envs/mail.env
  - ./envs/mysql.env

We set up a Gitlab CI and are planning to use Docker Swarm, so no more manual creation of production env files, use CI/CD. And the primary way in Gitlab is to create variables one by one. We could create file type variable and put the contents of env file in it, but it will be hard to manage those inner-variables.

So how do I have to work with env vars now?

  • Create a ton of variables in Gitlab UI and aggregate them in env files?
  • Use file type variables?
  • Pass them to services in docker-compose.yml file like this:

    environment:

    • VAR1
    • VAR2 ...
    • VAR20

Or should we also use Docker secrets or some configuration management tool?

0

There is stages in gitlab ci and on 'docker build' stage I don't need ALL env variables. Usually its only a REACT_APP_SERVER_URI variable. Later I use env file in compose.yml like you are.

env_file:
  - ./envs/common.env
| improve this answer | |
  • Thank you, but how do you fill those env files with CI system? – ahtohio Oct 1 '19 at 5:50
  • Manually =) Because developers always need to change them. So the simpliest way is do it directly on host. – Vasiliy Shakhunov Oct 1 '19 at 6:29
  • Is this a right way? I mean, most of env vars don't change often and with all CI automation having to manually create some env files in production is weird. – ahtohio Oct 1 '19 at 7:29
  • I think automation is compromise between complexity and profit from it. Real secure deployment requires something like Hashicorp Vault cluster installation. I didn't see good secret managent solution in Chef automation. Maybe Ansible does. – Vasiliy Shakhunov Oct 1 '19 at 17:02
  • 1
    Creating env files from gitlab ci variables has it's own deficiencies, but nothing can be done here. Oh well, I hoped for some well-known way or practice. Thank you for your patience. – ahtohio Oct 3 '19 at 6:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.