Can't read environment variable set in docker-compose about shiny

[markegge]

I ran into this issue myself a couple months ago. From what I recall, for security reasons Shiny isn't able to access environmental variables set by Docker. One workaround is to define your environmental variables in a .Renviron file and copy this file into /home/shiny/.

For example, my .Renviron file:

DBHOST=db
DBNAME=txdb
DBUSER=postgres
DBPASS=XXXXXXXXXXX

And my Dockerfile:

FROM rocker/shiny-verse
RUN R -e "install.packages(c('data.table', 'DT', 'leaflet'), repos='https://cran.rstudio.com/')"
RUN rm -rf /srv/shiny-server
WORKDIR /srv/shiny-server
COPY --chown=shiny:shiny . ./
COPY --chown=shiny:shiny .Renviron /home/shiny/.Renviron
EXPOSE 3838

[Chrisjb]

Thanks, I ended up doing something pretty similar to that. It's not an ideal solution for me though since some of my deployments build from github or dockerhub and I don't want my environment variables on a public repo.

Would be ideal if shiny server could access environment variables set on the container rather than wiping them as it currently does. As you say doesn't seem to be an option currently.

[cboettig]

👍 Thanks all for the comments. I agree it would be nicer if rstudio-server and shiny-server read env vars from the environment instead of only though the .Renviron files, but afaik that's the only option and is what we do in our Dockerfile recipes as well. Feel free to raise the issue with the RStudio developers, as this is ultimately their choice. They have been gracious in allowing Rocker explicit permission to package their open source products this way, and obviously they have commercial products in the same space.

We welcome other suggestions for working around these issues as well.

[johanneshk]

Here's my workaround: I override the CMD and simply dump all env variables into .Renviron:

CMD env > /home/shiny/.Renviron && shiny-server

This way you can still define the env variables in e.g. your docker-compose.yml or via an env file and don't have to hard-code into the Dockerfile.

I have a question about the security aspect: If shiny shouldn't access env variables for security reasons (why?) then 'read-only' access would be fine? I could only imagine, if shiny writes some env variables, that would pose a risk?

[eitsupi]

For Images with tags >= 4.0.0, which are currently maintained, this issue was resolved by rocker-org/rocker-versioned2#320.
So I close this issue.