World map

 

BM

World D4: Set Meals

.env and variables

You will learn: to fill blanks in compose.yaml from a .env file.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

Your compose.yaml says POSTGRES_PASSWORD: example. You push it to a public repo. Who can read the password now?

Watch

  db:
    image: postgres:18-alpine
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD:?add DB_PASSWORD to .env}

Your laptop~/kedai-kancil

  • No open hatches

Lunchboxes (containers)

  • No containers yet

Frozen packs (images)

  • kedai-kancil-api:latest6 layers · 244MB
  • kedai-kancil-web:latest9 layers · 92.6MB
  • nginx:1.30-alpine8 layers · 93.5MB
  • node:24-alpine4 layers · 244MB
  • postgres:18-alpine9 layers · 433MB
  • redis:8-alpine7 layers · 162MB

An order slip with a blank. ${DB_PASSWORD} is a blank that Compose fills in. That is interpolation: Blanks like ${DB_PASSWORD} in compose.yaml that Compose fills in from your shell or a .env file.. :? means: stop if it stays empty.

Try it

Fill the blank. Put the password in a .env file: A file next to compose.yaml with lines like DB_PASSWORD=devpass. Keep it out of Git. next to compose.yaml. Then start the shop.

Your laptop~/kedai-kancil

  • No open hatches

Lunchboxes (containers)

  • No containers yet

Frozen packs (images)

  • kedai-kancil-api:latest6 layers · 244MB
  • kedai-kancil-web:latest9 layers · 92.6MB
  • nginx:1.30-alpine8 layers · 93.5MB
  • node:24-alpine4 layers · 244MB
  • postgres:18-alpine9 layers · 433MB
  • redis:8-alpine7 layers · 162MB

Predict

The web hatch is a blank with a default: "${WEB_PORT:-8080}:80". Your .env has no WEB_PORT line. Which hatch opens?

Check

Swipe right if it is safe to commit to Git. Swipe left if not.

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

compose.yaml with ${DB_PASSWORD} in it

You did it!

You can now fill blanks in compose.yaml from a .env file.

Go deeper (optional)

Shell variables beat .env: WEB_PORT=9090 docker compose up -d opens hatch 9090. --env-file prod.env reads another file. env_file: on a service is different: it hands variables to the box itself. docker compose config shows every blank filled in. More on real secrets: World C3.

Real mission

  1. echo "DB_PASSWORD=devpass" > .env
  2. echo ".env" >> .gitignore
  3. docker compose config

0 of 3 steps done · Your ticks are saved.