Skip to content

fix(docker): stop the container entrypoint printing database connection strings in logs #4346

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ericallam merged 1 commit into from
Jul 23, 2026
+14 −0
Merged

fix(docker): stop the container entrypoint printing database connection strings in logs #4346

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .server-changes/entrypoint-no-log-db-connection-strings.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
---
area: webapp
type: fix
---

Container startup no longer prints database and ClickHouse connection strings (with credentials) to the logs.
8 changes: 8 additions & 0 deletions docker/scripts/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,9 @@ fi

# Run-ops split: migrate the dedicated NEW run-ops database only when it is configured. Single-DB
# installs never set the URL, so this is a no-op there.
{ set +x; } 2>/dev/null
if [ -n "$RUN_OPS_DATABASE_URL" ]; then
set -x
if [ "$SKIP_RUN_OPS_MIGRATIONS" != "1" ]; then
echo "Running run-ops migrations"
pnpm --filter @internal/run-ops-database db:migrate:deploy
Expand All @@ -24,13 +26,16 @@ if [ -n "$RUN_OPS_DATABASE_URL" ]; then
echo "SKIP_RUN_OPS_MIGRATIONS=1, skipping run-ops migrations."
fi
else
set -x
echo "RUN_OPS_DATABASE_URL not set, skipping run-ops migrations."
fi

# Run-ops split: keep the legacy runs DB's schema current by applying the full @trigger.dev/database
# migrations to it too, pointed at its direct (non-pooled) URL. Only runs when that URL is configured;
# installs that never set it skip this entirely.
{ set +x; } 2>/dev/null
if [ -n "$RUN_OPS_LEGACY_DIRECT_URL" ]; then
set -x
if [ "$SKIP_RUN_OPS_LEGACY_MIGRATIONS" != "1" ]; then
echo "Running legacy run-ops migrations"
# Subshell with tracing off so `set -x` does not print the DSN (with credentials) to the logs.
Expand All @@ -40,6 +45,7 @@ if [ -n "$RUN_OPS_LEGACY_DIRECT_URL" ]; then
echo "SKIP_RUN_OPS_LEGACY_MIGRATIONS=1, skipping legacy run-ops migrations."
fi
else
set -x
echo "RUN_OPS_LEGACY_DIRECT_URL not set, skipping legacy run-ops migrations."
fi

Expand All @@ -51,6 +57,7 @@ else
echo "SKIP_DASHBOARD_AGENT_MIGRATIONS=1, skipping dashboard agent migrations."
fi

{ set +x; } 2>/dev/null
if [ -n "$CLICKHOUSE_URL" ] && [ "$SKIP_CLICKHOUSE_MIGRATIONS" != "1" ]; then
# Run ClickHouse migrations
echo "Running ClickHouse migrations..."
Expand All @@ -76,6 +83,7 @@ elif [ "$SKIP_CLICKHOUSE_MIGRATIONS" = "1" ]; then
else
echo "CLICKHOUSE_URL not set, skipping ClickHouse migrations."
fi
set -x

# Copy over required prisma files
cp internal-packages/database/prisma/schema.prisma apps/webapp/prisma/
Expand Down