Docker exposing vital info in DSM

[paboman]

hello,
I noticed that Synology DSM is exposing vital information in the docker information panel

Is there a way to hide them ?

[stefan0xC]

I think you could change the environment variables so that Vaultwarden reads the value from a file (i.e. with ADMIN_TOKEN_FILE=/data/admin-token instead of ADMIN_TOKEN), then Vaultwarden should read the file instead of displaying the content (when printing the environment variables of the container). Alternatively you could also mount an environment file to /.env (or set a variable ENV_FILE=/data/secrets.env if you don't want to change your volume mounts) so Vaultwarden will read this file on startup.

[stefan0xC]

What do you mean?

[deajan]

@paboman Just replace -e ADMIN_TOKEN=abc with --env-file=/data/.env in your docker commandline.
Create the /data/.env file by adding at least ADMIN_TOKEN=abc inside.
You can find full examples of the env file in the vaultwarden doc.

[stefan0xC]

@deajan that's not gonna help with displaying the environment variables of the container (also the file would have to be relative to the host not the container and it does not have to be in /data for docker to access the file either).

[BobWs]

If using the .env file Synology will still expose all the secret information from the file into the GUI. What does work and hide your sensitive info is docker secrets.

[stefan0xC]

Just to clarify: My first suggestion was to change

ADMIN_TOKEN='$argon2id$v=19$m=65540,t=3,p=4$uvpHN+9gE+zfwySrXTarFPjvJmq9DT6+eyVG3HcbNeI$xPz43ODNa4LRLUSZOi3DYa9j9aFnah6Axx5SOLriorQ'

into ADMIN_TOKEN_FILE=data/admin-token and copy the string (inside the single quotes) into the new file data/admin-token:

$argon2id$v=19$m=65540,t=3,p=4$uvpHN+9gE+zfwySrXTarFPjvJmq9DT6+eyVG3HcbNeI$xPz43ODNa4LRLUSZOi3DYa9j9aFnah6Axx5SOLriorQ

and repeat this process for other variables you don't want to display. If you use docker secrets as suggested by @BobWs I think you would have to set ADMIN_TOKEN_FILE=/run/secrets/admin-token accordingly.

My alternative suggestion would be to something similar to what @deajan suggested, just instead of loading the .env file with docker you would tell Vaultwarden where this file is. I.e. set ENV_FILE=/data/.env (or if you mount the file to /.env you could skip setting the ENV_FILE).

Either way this will prevent docker from displaying the values because the environment variables will not be attached to the container.