title: Docker, AspNetCore, DB connection string best practices
body: <p>I've been spending the last week or so attempting to learn docker and all the things it can do, however one thing I'm struggling to get my head around is the best practice on how to manage secrets, especially around database connection strings and how these should be stored.</p>
  
  <p>I have a plan in my head where I want to have a docker image, which will contain an ASP.NET Core website, MySQL database and a PHPMyAdmin frontend, and deploy this onto a droplet I have at DigitalOcean.</p>
  
  <p>I've been playing around a little bit and I have a docker-compose.yml file which has the MySQL DB and PhpMyAdmin correctly linked together</p>
  
  <pre><code>version: "3"
  
  services:
    db:
      image: mysql:latest
      container_name: mysqlDatabase
      environment:
      - MYSQL_ROOT_PASSWORD=0001
      - MYSQL_DATABASE=atestdb
      restart: always
      volumes:
      - /var/lib/mysql
    phpmyadmin:
      image: phpmyadmin/phpmyadmin
      container_name: db-mgr
      ports:
      - "3001:80"
      environment:
      - PMA_HOST=db
      restart: always
      depends_on:
      - db
  </code></pre>
  
  <p>This is correctly creating a MySQL DB for me and I can connect to it with the running PHPMyAdmin front end using root / 0001 as the username/password combo.</p>
  
  <p>I know I would now need to add my AspNetCore web app to this, but I'm still stumped by the best way to have my DB password. </p>
  
  <p>I have looked at docker swarm/secrets, but I still don't fully understand how this works, especially if I want to check my docker-compose file into GIT/SCM. Other things I have read have suggested using environment variables, but I still don't seem to understand how that is any different to just checking in the connection string in my appsettings.json file, or for that matter, how this would work in a full CI/CD build pipeline. </p>
  
  <p>This <a href="https://stackoverflow.com/questions/46170736/setup-aspnetcore-with-mysql-database-in-docker">question</a> helped my out a little getting to this point, but they still have their DB password in their docker-compose file.</p>
  
  <p>It might be that I'm trying to overthink this</p>
  
  <p>Any help, guidance or suggestions would be gratefully received.</p>