Docker secrets not loading

[nblazincic]

Docker image 3.8.14-management-alpine not loading default user/password via RABBITMQ_DEFAULT_USER_FILE or PASS variable pointing to docker secrets (ie, /run/secrets/rmq_username)

rolling back to 3.8.5 image works.

[nblazincic]

Just to update, after upgrading to 3.8.14 no issues. I guess this is problem only with initial user creation.
Some environment specifics (didn't have time to write this down before).
Docker version 20.10.5, build 55c4c88
docker-compose version 1.29.0, build 07737305

Docker-compose file example:

version: '3.8'
x-common-variables:
  &common-variables
   RABBITMQ_DEFAULT_USER_FILE: "/run/secrets/rmq_username"
   RABBITMQ_DEFAULT_PASS_FILE: "/run/secrets/rmq_password"
services:
  rmqnode01:
    image: imagename
    user: "999:999"
    hostname: rmqnode01
    deploy:
      restart_policy:
        condition: on-failure
        delay: 10s
    environment:
      *common-variables
    secrets:
      - rmq_username
      - rmq_password
      - source: rmq_cookie
        target: /var/lib/rabbitmq/.erlang.cookie
        uid: "999"
        gid: "999"
        mode: 0600
    volumes:
      - /data/rmq/data:/var/lib/rabbitmq
secrets:
  rmq_username:
    external: true
  rmq_password:
    external: true
  rmq_cookie:
    external: true
networks:
  default:
    name: some-network
    external: true

Also posted on rabbitmq/rabbitmq-server#2963

[michaelklishin]

I doubt any time will be spent on this given that heavy env variable use in this image is going away: #440, #424.

[nblazincic]

So if the plan is to configure initial users via config files, that would mean (in docker swarm and my example here) to create a docker secret containing the complete config file itself, with initial password in it.

[michaelklishin]

Instead of using environment variables (that end up rabbitmq.conf), you have three options:

• Use rabbitmq.conf of your own, and specify default_user and default_password in it
• Use advanced.config and value encryption
• Import a pre-created definition file on boot (which contains a password + salt hash)

You can store the entire rabbitmq.conf contents in a secret but that does not seem to be necessary: you don't have to rely on plain text values with the above options. I don't see why it would not work with a custom image based on this one, though.

[nblazincic]

Tnx for your input.