From 67d5fc775a75c0fea7f81ebdb97d8e8d6ec03ceb Mon Sep 17 00:00:00 2001
From: yeasy <yangbaohua@gmail.com>
Date: Thu, 4 Jun 2026 01:02:59 -0700
Subject: [PATCH] fix(content): harden Compose credential examples

---
 11_compose/11.7_rails.md     | 6 +++---
 11_compose/11.8_wordpress.md | 7 +++++--
 appendix/repo/mysql.md       | 2 +-
 docker-compose.yml           | 2 --
 4 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/11_compose/11.7_rails.md b/11_compose/11.7_rails.md
index 35ada66..fb7cca2 100644
--- a/11_compose/11.7_rails.md
+++ b/11_compose/11.7_rails.md
@@ -96,14 +96,14 @@ $ touch Gemfile.lock
 
 ### 11.7.5 步骤 3：创建 compose.yaml
 
-配置如下：
+配置如下。下面为了本地练习使用环境变量占位；不要把真实数据库密码写进 `compose.yaml`、`.env` 或 Git，生产环境应使用 Compose secrets、Rails credentials 或平台密钥管理。
 
 ```yaml
 services:
   db:
     image: postgres:16
     environment:
-      POSTGRES_PASSWORD: password
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
@@ -123,7 +123,7 @@ services:
       db:
         condition: service_healthy
     environment:
-      DATABASE_URL: postgres://postgres:password@db:5432/myapp_development
+      DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@db:5432/myapp_development
 
 volumes:
   postgres_data:
diff --git a/11_compose/11.8_wordpress.md b/11_compose/11.8_wordpress.md
index c1e67a4..371e27d 100644
--- a/11_compose/11.8_wordpress.md
+++ b/11_compose/11.8_wordpress.md
@@ -157,7 +157,7 @@ $ docker compose logs -f
 ```bash
 ## 导出 SQL
 
-$ docker exec wordpress_db mysqldump -u wordpress -pwordpress wordpress > backup.sql
+$ docker compose exec -T db sh -c 'tmp=$(mktemp) && printf "[client]\nuser=wordpress\npassword=%s\n" "$(cat /run/secrets/db_password)" > "$tmp" && mysqldump --defaults-extra-file="$tmp" wordpress; rc=$?; rm -f "$tmp"; exit "$rc"' > backup.sql
 ```
 或者添加一个自动备份容器：
 
@@ -171,8 +171,11 @@ $ docker exec wordpress_db mysqldump -u wordpress -pwordpress wordpress > backup
       - DB_HOST=db
       - DB_NAME=wordpress
       - DB_USER=wordpress
-      - DB_PASS=${DB_PASSWORD}
+      # 选用支持从文件读取密码的备份镜像，或用自定义 entrypoint 从 secret 文件注入。
+      - DB_PASS_FILE=/run/secrets/db_password
       - DB_DUMP_FREQ=1440 # 每天备份一次
+    secrets:
+      - db_password
     depends_on:
       - db
     networks:
diff --git a/appendix/repo/mysql.md b/appendix/repo/mysql.md
index f161e26..198d40e 100644
--- a/appendix/repo/mysql.md
+++ b/appendix/repo/mysql.md
@@ -33,7 +33,7 @@ $ docker run --name some-app -d --network my-mysql-net application-that-uses-mys
 $ docker run -it --rm \
     --network my-mysql-net \
     mysql \
-    sh -c 'exec mysql -hsome-mysql -P3306 -uroot -pmysecretpassword'
+    sh -c 'exec mysql -hsome-mysql -P3306 -uroot -p'
 ```
 
 ### Dockerfile
diff --git a/docker-compose.yml b/docker-compose.yml
index f26fcfe..f29b696 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,5 +1,3 @@
-version: "3"
-
 services:
 
   mdpress-build: