From 690a57297000b1ca4354bc9327b1cd19b2e981f5 Mon Sep 17 00:00:00 2001
From: Eric Allam <eallam@icloud.com>
Date: Thu, 23 Jul 2026 11:34:26 +0100
Subject: [PATCH] fix(docker): stop the container entrypoint printing database
 connection strings in logs

The entrypoint runs under set -x, which echoes each command with variables
expanded. The RUN_OPS_DATABASE_URL and RUN_OPS_LEGACY_DIRECT_URL guards and the
ClickHouse block referenced full connection strings, so the DSN (with password)
was printed to the container logs on every boot. Turn tracing off around those
regions and restore it after, leaving migration behavior unchanged.
---
 .../entrypoint-no-log-db-connection-strings.md            | 6 ++++++
 docker/scripts/entrypoint.sh                              | 8 ++++++++
 2 files changed, 14 insertions(+)
 create mode 100644 .server-changes/entrypoint-no-log-db-connection-strings.md

diff --git a/.server-changes/entrypoint-no-log-db-connection-strings.md b/.server-changes/entrypoint-no-log-db-connection-strings.md
new file mode 100644
index 0000000000..611408cf14
--- /dev/null
+++ b/.server-changes/entrypoint-no-log-db-connection-strings.md
@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Container startup no longer prints database and ClickHouse connection strings (with credentials) to the logs.
diff --git a/docker/scripts/entrypoint.sh b/docker/scripts/entrypoint.sh
index 1871755f98..1e5c7c7cab 100755
--- a/docker/scripts/entrypoint.sh
+++ b/docker/scripts/entrypoint.sh
@@ -15,7 +15,9 @@ fi
 
 # Run-ops split: migrate the dedicated NEW run-ops database only when it is configured. Single-DB
 # installs never set the URL, so this is a no-op there.
+{ set +x; } 2>/dev/null
 if [ -n "$RUN_OPS_DATABASE_URL" ]; then
+  set -x
   if [ "$SKIP_RUN_OPS_MIGRATIONS" != "1" ]; then
     echo "Running run-ops migrations"
     pnpm --filter @internal/run-ops-database db:migrate:deploy
@@ -24,13 +26,16 @@ if [ -n "$RUN_OPS_DATABASE_URL" ]; then
     echo "SKIP_RUN_OPS_MIGRATIONS=1, skipping run-ops migrations."
   fi
 else
+  set -x
   echo "RUN_OPS_DATABASE_URL not set, skipping run-ops migrations."
 fi
 
 # Run-ops split: keep the legacy runs DB's schema current by applying the full @trigger.dev/database
 # migrations to it too, pointed at its direct (non-pooled) URL. Only runs when that URL is configured;
 # installs that never set it skip this entirely.
+{ set +x; } 2>/dev/null
 if [ -n "$RUN_OPS_LEGACY_DIRECT_URL" ]; then
+  set -x
   if [ "$SKIP_RUN_OPS_LEGACY_MIGRATIONS" != "1" ]; then
     echo "Running legacy run-ops migrations"
     # Subshell with tracing off so `set -x` does not print the DSN (with credentials) to the logs.
@@ -40,6 +45,7 @@ if [ -n "$RUN_OPS_LEGACY_DIRECT_URL" ]; then
     echo "SKIP_RUN_OPS_LEGACY_MIGRATIONS=1, skipping legacy run-ops migrations."
   fi
 else
+  set -x
   echo "RUN_OPS_LEGACY_DIRECT_URL not set, skipping legacy run-ops migrations."
 fi
 
@@ -51,6 +57,7 @@ else
   echo "SKIP_DASHBOARD_AGENT_MIGRATIONS=1, skipping dashboard agent migrations."
 fi
 
+{ set +x; } 2>/dev/null
 if [ -n "$CLICKHOUSE_URL" ] && [ "$SKIP_CLICKHOUSE_MIGRATIONS" != "1" ]; then
   # Run ClickHouse migrations
   echo "Running ClickHouse migrations..."
@@ -76,6 +83,7 @@ elif [ "$SKIP_CLICKHOUSE_MIGRATIONS" = "1" ]; then
 else
   echo "CLICKHOUSE_URL not set, skipping ClickHouse migrations."
 fi
+set -x
 
 # Copy over required prisma files
 cp internal-packages/database/prisma/schema.prisma apps/webapp/prisma/