fix(content): harden Compose credential examples

11_compose/11.7_rails.md

@@ -96,14 +96,14 @@ $ touch Gemfile.lock
 
 ### 11.7.5 步骤 3：创建 compose.yaml
 
-配置如下：
+配置如下。下面为了本地练习使用环境变量占位；不要把真实数据库密码写进 `compose.yaml`、`.env` 或 Git，生产环境应使用 Compose secrets、Rails credentials 或平台密钥管理。
 
 ```yaml
 services:
   db:
     image: postgres:16
     environment:
-      POSTGRES_PASSWORD: password
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
@@ -123,7 +123,7 @@ services:
       db:
         condition: service_healthy
     environment:
-      DATABASE_URL: postgres://postgres:password@db:5432/myapp_development
+      DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@db:5432/myapp_development
 
 volumes:
   postgres_data:

11_compose/11.8_wordpress.md

@@ -157,7 +157,7 @@ $ docker compose logs -f
 ```bash
 ## 导出 SQL
 
-$ docker exec wordpress_db mysqldump -u wordpress -pwordpress wordpress > backup.sql
+$ docker compose exec -T db sh -c 'tmp=$(mktemp) && printf "[client]\nuser=wordpress\npassword=%s\n" "$(cat /run/secrets/db_password)" > "$tmp" && mysqldump --defaults-extra-file="$tmp" wordpress; rc=$?; rm -f "$tmp"; exit "$rc"' > backup.sql
 ```
 或者添加一个自动备份容器：
 
@@ -171,8 +171,11 @@ $ docker exec wordpress_db mysqldump -u wordpress -pwordpress wordpress > backup
       - DB_HOST=db
       - DB_NAME=wordpress
       - DB_USER=wordpress
-      - DB_PASS=${DB_PASSWORD}
+      # 选用支持从文件读取密码的备份镜像，或用自定义 entrypoint 从 secret 文件注入。
+      - DB_PASS_FILE=/run/secrets/db_password
       - DB_DUMP_FREQ=1440 # 每天备份一次
+    secrets:
+      - db_password
     depends_on:
       - db
     networks: