Does docker compose log environment variables loaded by env_file?

Question

We can load random data into a container like this:

vars.env

FOO=123
BAR=abc

docker-compose.yml

my_service:
  image: my_image
  env_file:
    - ./vars.env
  # ...

Is it possible that those environment variables will be logged?

(I'm running the container on linux.)

Answer 1

Although I cannot exactly point you to a case where docker (and docker-compose) logs environment variables, I would imagine it's very much likely since docker does not treat environment-variables as secrets. Therefore, if you are concerned about your env variables getting logged, you should use docker secrets instead.

You should be able to find plenty of examples on the internet on how to utilize this Docker feature in docker-compose. Here's the official one for example: https://docs.docker.com/compose/use-secrets/

It's pretty simple to use but in this case, you can be 100% certain that your secret's plaintext values won't appear anywhere.