Docker Compose中POSTGRES_PASSWORD_FILE配置失效求助

使用以下Docker Compose配置及postgres_password_file时遇到问题，配置未生效。已确认容器内文件内容正确且权限无误，但PostgreSQL仅创建了默认postgres用户，且找不到匹配该用户的密码，同时未创建指定的dbUser。

相关配置及日志 #

Docker Compose配置 #

version: '2'
services:

  db:
    image: postgres:11
    restart: always
    user: postgres
    environment:
      - POSTGRES_PASSWORD_FILE=/run/secrets/pgpassfile
    secrets:
      - pgpassfile

secrets:
  pgpassfile:
    file: ./pgpassfile

pgpassfile内容（容器内外均由postgres(999)用户拥有） #

*:5432:*:dbUser:password

PostgreSQL服务器日志 #

[+] Running 2/2                                                        
 ✔ Network scripts_default  Created                                                                       0.1s 
 ✔ Container scripts-db-1   Created                                                                       0.2s 
Attaching to db-1                                                                                              
db-1  | The files belonging to this database system will be owned by user "postgres".
db-1  | This user must also own the server process.          
db-1  |                                                                        
db-1  | The database cluster will be initialized with locale "en_US.utf8".
db-1  | The default database encoding has accordingly been set to "UTF8".
db-1  | The default text search configuration will be set to "english".       
db-1  |                                                            
db-1  | Data page checksums are disabled.                    
db-1  |                                                                        
db-1  | fixing permissions on existing directory /var/lib/postgresql/data ... ok
db-1  | creating subdirectories ... ok                       
db-1  | selecting default max_connections ... 100                             
db-1  | selecting default shared_buffers ... 128MB    
db-1  | selecting default timezone ... Etc/UTC
db-1  | selecting dynamic shared memory implementation ... posix                                               
db-1  | creating configuration files ... ok
db-1  | running bootstrap script ... ok                                       
db-1  | performing post-bootstrap initialization ... ok
db-1  | 
db-1  | WARNING: enabling "trust" authentication for local connections
db-1  | You can change this by editing pg_hba.conf or using the option -A, or
db-1  | --auth-local and --auth-host, the next time you run initdb.
db-1  | syncing data to disk ... ok
db-1  | 
db-1  | Success. You can now start the database server using:
db-1  | 
db-1  |     pg_ctl -D /var/lib/postgresql/data -l logfile start
db-1  | 
db-1  | waiting for server to start....LOG:  database system was shut down at 2024-02-09 13:52:25 UTC
db-1  | LOG:  MultiXact member wraparound protections are now enabled
db-1  | LOG:  database system is ready to accept connections
db-1  | LOG:  autovacuum launcher started
db-1  |  done
db-1  | server started
db-1  | 
db-1  | /usr/local/bin/docker-entrypoint.sh: ignoring /docker-entrypoint-initdb.d/*
db-1  | 
db-1  | LOG:  received fast shutdown request
db-1  | waiting for server to shut down...LOG:  aborting any active transactions
db-1  | .LOG:  autovacuum launcher shutting down
db-1  | LOG:  shutting down
db-1  | LOG:  database system is shut down
db-1  |  done
db-1  | server stopped
db-1  | 
db-1  | PostgreSQL init process complete; ready for start up.
db-1  | 
db-1  | LOG:  database system was shut down at 2024-02-09 13:52:27 UTC
db-1  | LOG:  MultiXact member wraparound protections are now enabled
db-1  | LOG:  autovacuum launcher started
db-1  | LOG:  database system is ready to accept connections

排查思路 #

• 明确POSTGRES_PASSWORD_FILE的作用：该环境变量仅用于设置默认postgres用户的密码，无法直接创建自定义用户dbUser。要创建自定义用户，需同时设置POSTGRES_USER环境变量，或者通过docker-entrypoint-initdb.d目录下的初始化脚本实现。
• 修正pgpassfile格式：POSTGRES_PASSWORD_FILE要求文件内容仅包含纯密码字符串，不能使用pgpass客户端配置格式（*:5432:*:dbUser:password）。当前文件格式错误，导致Postgres无法识别密码。
• 确认初始化流程是否触发：如果容器之前已运行过，Postgres会复用已有数据卷，跳过初始化步骤。可删除旧数据卷（docker volume rm <对应卷名>）后重新启动容器，确保初始化逻辑执行。
• 验证secrets挂载正确性：进入容器执行cat /run/secrets/pgpassfile，确认文件内容是否为纯密码，而非pgpass格式的字符串。
• 检查镜像版本兼容性：Postgres 11镜像对secrets的支持可能存在限制，可尝试升级至较新版本镜像测试，或查阅官方文档确认POSTGRES_PASSWORD_FILE的使用要求。

最终解决方法（2024/04/15更新） #

通过环境变量结合未纳入仓库的.env文件解决问题，示例配置如下：

db:
    image: postgres:11
    restart: always
    container_name: postgres-db
    environment:
      - POSTGRES_USER=${PGUSER}
      - POSTGRES_PASSWORD=${PGPASS}
      - POSTGRES_DB=${PGDB}
    ports:
      - "5432:5432"
    volumes:
      - ./db/data:/var/lib/postgresql/data
      - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql

注：需在项目根目录创建.env文件，定义PGUSER、PGPASS、PGDB变量，且确保该文件不纳入版本控制。

内容的提问来源于stack exchange，提问作者Diego Pedro