Take Secrets out of a Compose File

Labs have no container engine, so nothing is built or started: your files are checked by reading them, the way a reviewer or a CI linter would. docker-compose config (to validate Compose files) and hadolint (a Dockerfile linter) are installed.

/home/student/projects/scheduler-ui/compose.yaml is in Git with the database password typed into it, the database loses its data when the container is recreated, and the admin port is open to the whole network.

Task

• The password value must no longer appear in compose.yaml. Read it from a variable POSTGRES_PASSWORD defined in a .env file next to it (same password as today). Both services must still receive it.
• Store the database data in a named volume pgdata, mounted at /var/lib/postgresql/data.
• Publish admin's port 8081 on the host only on 127.0.0.1 (same host port 8081).
• docker-compose config must accept the file.