From be9104ac46f72026568310f86a516b5773489bda Mon Sep 17 00:00:00 2001 From: Austin Burdine Date: Thu, 27 Aug 2026 14:53:15 -0400 Subject: [PATCH] Update Ghost docs to include info about run secrets no issue - add docs about _File environment variables + support for run secrets --- ghost/content.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/ghost/content.md b/ghost/content.md index a595a019c3cc..2c113ff8b778 100644 --- a/ghost/content.md +++ b/ghost/content.md @@ -70,6 +70,27 @@ $ docker run -d --name some-ghost -e NODE_ENV=development -e url=http://some-gho (There are further configuration examples in the `compose.yaml` listed below.) +## Docker Secrets + +As an alternative to passing sensitive configuration values via environment variables, `_FILE` may be appended to a Ghost configuration environment variable, causing Ghost to read that value from a file in the container instead. In particular, this can be used to load secrets from Docker secrets stored in `/run/secrets/` files. For example: + +```console +$ docker run -d \ + --name some-ghost \ + -e database__client=mysql \ + -e database__connection__host=some-mysql \ + -e database__connection__user=ghost \ + -e database__connection__password_FILE=/run/secrets/ghost-db-password \ + -e database__connection__database=ghost \ + %%IMAGE%% +``` + +This is supported for any nested configuration key (that is, any key containing at least one `__` separator), such as `database__connection__password` or `mail__options__auth__pass`. Top-level keys such as `url` are deliberately excluded, so that unrelated variables like `SSL_CERT_FILE` are not mistaken for Ghost configuration. + +A single trailing newline is stripped from the file's contents (matching `$(cat file)` behavior); any other surrounding whitespace is preserved, in case it is part of the secret. Setting both `foo__bar` and `foo__bar_FILE`, or pointing two variables which resolve to the same configuration key at different files, is an error and Ghost will refuse to start. + +Note: this requires Ghost 6.58.0 or newer. + ## What is the Node.js version? When opening a ticket at https://github.com/TryGhost/Ghost/issues it becomes necessary to know the version of Node.js in use: