Docker and Ansible Vault: An insecure match?

Archives Ansible Project
1

Ansible Vault requires to prompt the user for a password or a file containing the password. But if I’m running Ansible inside of a container, I cannot prompt the user for a password.

How can I run a playbook using vars encrypted by Vault during a Docker build?
How can I do it without exposing a password file?
Is there a best practice?

2

How can I run a playbook using vars encrypted by Vault during a Docker build?

Don’t

How can I do it without exposing a password file?
Is there a best practice?

Give sensitive information to the docker container as environment values. See e.g. https://registry.hub.docker.com/_/postgres/ and POSTGRES_PASSWORD

Cheers,
Paul