Follow-ups to the 9 secret-hardening commits (each verified against
docs.docker.com / vendor docs; one outright new bug found and fixed):
- 11.6: eb5e4397 changed settings.py to a hard os.environ lookup but the
web service never receives POSTGRES_PASSWORD (only db does; DATABASE_URL
is set but never read) -> step-6 'docker compose up' crashed with
KeyError. Pass the var to web; harden the leftover literal password in
the 配置详解 snippet that contradicted the new guidance two lines down;
blank line after the inserted sentence (bold heading merged into the
paragraph); dev/prod table no longer claims dev uses 明文 passwords
- 11.8: FAQ still told readers to check passwords in .env after the same
file banned passwords in .env -> point at secrets/db_password.txt;
backup sidecar env vars updated to tiredofit/db-backup 4.x interface
(DB01_* + DB01_PASS_FILE + DB01_BACKUP_INTERVAL - the unprefixed DB_*
names are ignored by current :latest; verified against upstream README)
- demo/wordpress: compose now references secrets files that ship nowhere
-> add README with the creation commands from 11.8; demo/django: align
with the hardened 11.6 (env-injected password, passed to web too)
- 04_image multistage demos: go build without go.mod fails on module-mode
Go (reproduced by reviewer on go1.26) -> add 'go mod init helloworld'
matching the 7.17 doc pattern in all three Dockerfiles
- 21.7: init script reworked init-db.sql -> init-db.sh per the official
image's env-reading .sh hook - removes the baked 'secure_password' AND
the CREATE DATABASE myappdb collision with POSTGRES_DB that aborted
first-boot init (ON_ERROR_STOP); compose passes APP_DB_PASSWORD;
microservices init.sql mount annotated schema-only (POSTGRES_USER:
appuser would collide with CREATE USER); Dockerfile-redis healthcheck
now authenticates via REDISCLI_AUTH read from redis.conf (plain
redis-cli ping gets NOAUTH against requirepass - same class as the
compose sibling eb5e4397 already fixed); dev-container dev/dev creds
annotated local-only
- 19.3: Grafana admin password 'admin' sat directly under the newly added
security warning -> env-injected like the rest of the stack
Docker Engine 29.0.0 was released 2025-11-10 per docs.docker.com release
notes, not 2025-11-11 (off by one day). Also bring docker/login-action
reference in 18.6 up to v4 to match the 21.2 example (v4 has been current
since 2026-03-04).
- Enforce Level 1-3 structural numbering based on SUMMARY.md hierarchy
- Remove structural numbering from Level 4+ headings
- Eliminate single child headings by converting to bold text
- Auto-inject summary text for headings with multiple children missing intro text
- Exclude Appendix chapters from structural numbering
- Avoid modifying code block contents
- Add script to detect non-standard English usage in headers
yeasy