Passing password environment variable to docker container

[EndeJoli]

We use docker container to run the build and publish the artifacts on remote agent. One of the problems we are facing is while passing the password environment variables to the container. We are using shell/batch commands to fetch all the environment variables(grep with bamboo) and pass it to the container while starting the docker run.  This works fine for all the variables except for passwords. For password variables when we read the environment variable all we get is ***** and that is what gets passed to the container.  

Is there any solution to pass the password variable to container correctly?

Thanks,

EndeJoli

[Jeremy Owen]

Hey EndeJoli,

I haven't had any luck reproducing this yet. The password masking (*****) should only be applied at a logging level for Bamboo. What actually gets passed to the underlying command should be the actual value.

For example, say I set a Bamboo plan variable of password = password123 and run the below Script task (I've used grep to be closer to your example, but you can also directly reference it with ${bamboo.password}):

password="$(env | grep "bamboo_password" | awk -F'=' '{print $2}')"
docker run -itd -e PASSWORD=${password} ubuntu:xenial

At any point, if password123 is output to the console -- it will show up in the build logs as ****** but the Docker container actually received the value password123.

I verified this on the host (outside of Bamboo) by attaching a shell to the container:

host$ docker exec -i -t container /bin/bash
container$ env
> PASSWORD=password123

Since Bamboo will mask any attempts to print that to the build log; have you tried verifying the value of the environment variable outside of a Bamboo build?