Does the minio/minio image support *_FILE credentials?

[dennisvang]

Our goal is to set up Minio via Docker, using Docker secrets (or kubernetes). For this reason it would be convenient if we could configure root credentials via files instead of environment variables, similar to the way it is done in the postgres image.

The root credentials docs do mention MINIO_ROOT_PASSWORD, and so on, but not MINIO_ROOT_PASSWORD_FILE. The same holds for the quickstart on Docker hub.

Does the minio/minio Docker image support file-based root credentials, like MINIO_ROOT_PASSWORD_FILE?

I assume it does (or did, at some point in time), based on the following related issue, but I cannot find any mention of it in the docs.

• Correct Docker Installation reference to key secret.  #349

Judging from image layer 21, there are indeed environment variables ending in _FILE, including MINIO_ROOT_PASSWORD_FILE:

ENV MINIO_ACCESS_KEY_FILE=access_key MINIO_SECRET_KEY_FILE=secret_key MINIO_ROOT_USER_FILE=access_key MINIO_ROOT_PASSWORD_FILE=secret_key MINIO_KMS_SECRET_KEY_FILE=kms_master_key MINIO_UPDATE_MINISIGN_PUBKEY=RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav MINIO_CONFIG_ENV_FILE=config.env MC_CONFIG_DIR=/tmp/.mc

Of course I've tried specifying MINIO_ROOT_PASSWORD_FILE in a compose file, and this appears to work as expected.

However, the fact that it is not documented makes me worry.

Is there a reason this is not documented?

If not, could you add a section in the docs explaining that one can use *_FILE based credentials?
It would also be great if this could be mentioned in the quickstart on Docker hub.

[ravindk89]

Taking a look I don't think we were leaving these hidden on purpose - likely we just missed them as it doesn't come up all that much.

I don't think there's any harm in adding it to the documentation - at a glance it's only a handful of envvars:

• MINIO_ROOT_USER_FILE
• MINIO_ROOT_SECRET_KEY_FILE
• MINIO_CONFIG_ENV_FILE (already documented)
• MINIO_KMS_KES_KEY_FILE
• MINIO_KMS_KES_CERT_FILE
• MINIO_KMS_SECRET_FILE

[ravindk89]

Ah - @dennisvang so part of why this is kind of moot is you can use MINIO_CONFIG_ENV_FILE to point to an environment file that you mount to your docker container - and all of these envvars can just live there instead. Which makes specifying individual file paths kind of extraneous .

Same with Kubernetes, whether using the Community Helm chart or our Operator - you'd modify the secret associated to the environment / config file and just handle passing values in there.

[dennisvang]

Ah - @dennisvang so part of why this is kind of moot is you can use MINIO_CONFIG_ENV_FILE to point to an environment file that you mount to your docker container - and all of these envvars can just live there instead. Which makes specifying individual file paths kind of extraneous .

Hi @ravindk89 thanks for the quick reply. Actually the approach using MINIO_CONFIG_ENV_FILE sounds great.
This did not come up in my search because I was focusing on the individual credential variables.

Perhaps it would be useful to mention MINIO_ROOT_USER_FILE and the other variables in the docs, with a note that it is easier to use MINIO_CONFIG_ENV_FILE?

[ravindk89]

Yep - our team is completely allocated to other tasks right now, so I cannot say when we will have cycles to return to our queue in this project, but we'll do our best to get around to it as time permits.

Otherwise if anyone else in the community feels like opening a PR I'd be happy to take a look.

[dennisvang]

@ravindk89 By the way, using a single MINIO_CONFIG_ENV_FILE instead of individual files for the credentials is not so convenient when you need to share those credentials between containers. For example a client container requiring only the username and password.