[BUG] FILE__ environment variables are not made into variables and are just set as the name

[DaanSelen]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

AS the name states. In my Docker compose I am trying to implement the secrets at as much places as possible. However the Docker image for Bookstack refuses to either read the file or be set into a variable.

FILE__myvar=/run/secrets/mypass literally becomes "/run/secrets/mypass"
And the variable name literally becomes: FILE__myvar

Expected Behavior

To either create the variable myvar with the contents of the file.

Steps To Reproduce

Docker compose and try to use docker secrets located at /run/secrets

Environment

- OS: Ubuntu 22.04 LTS
- How docker service was installed: Through the Docker website

CPU architecture

x86-64

Docker creation

Docker compose with any FILE__ variables

Container logs

bookstack-server    |   at /app/www/vendor/laravel/framework/src/Illuminate/Database/Connection.php:838
bookstack-server    |     834▕             $exceptionType = $this->isUniqueConstraintError($e)
bookstack-server    |     835▕                 ? UniqueConstraintViolationException::class
bookstack-server    |     836▕                 : QueryException::class;
bookstack-server    |     837▕
bookstack-server    |   ➜ 838▕             throw new $exceptionType(
bookstack-server    |     839▕                 $this->getNameWithReadWriteType(),
bookstack-server    |     840▕                 $query,
bookstack-server    |     841▕                 $this->prepareBindings($bindings),
bookstack-server    |     842▕                 $e,

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[Roxedus]

How do you verify its not working?

[aptalca]

FILE__myvar=/run/secrets/mypass literally becomes "/run/secrets/mypass"
And the variable name literally becomes: FILE__myvar

That's the variable that you set. Nothing "becomes" that.

If you posted the full container log as requested, we may have had an idea what's going on.

[github-actions]

A human has marked this issue as invalid, this likely happened because the issue template was not used in the creation of the issue.

[DaanSelen]

FILE__myvar=/run/secrets/mypass literally becomes "/run/secrets/mypass"
And the variable name literally becomes: FILE__myvar

That's the variable that you set. Nothing "becomes" that.

If you posted the full container log as requested, we may have had an idea what's going on.

I am trying not to expose the password itself. Let me draft up a full comment

[DaanSelen]

Compose:

services:
  bookstack:
    image: lscr.io/linuxserver/bookstack:25.12.8
    container_name: bookstack-server
    restart: unless-stopped
    networks:
      - traefik
      - bookstack-network
    expose:
      - "80"
    environment:
      PUID: 1000
      PGID: 1000
      TZ: Europe/Amsterdam

      APP_URL: https://docs.domain.com:443
      APP_KEY: /run/secrets/bookstack_appkey

      DB_HOST: mariadb
      DB_PORT: 3306
      DB_DATABASE: dyar-bookstack
      DB_USERNAME: dyar-bookstack-user
      DB_PASSWORD: /run/secrets/mariadb_pass
    volumes:
      - "/srv/bookstack/data:/config:rw"
    secrets:
      - "bookstack_appkey"
      - "mariadb_pass"
    depends_on:
      mariadb:
        condition: service_healthy

  mariadb:
    image: docker.io/mariadb:12.2-noble
    container_name: bookstack-database
    restart: unless-stopped
    networks:
      - bookstack-network
    expose:
      - "3306"
    environment:
      MARIADB_AUTO_UPGRADE: 1
      MARIADB_DATABASE: dyar-bookstack
      MARIADB_USER: dyar-bookstack-user
      MARIADB_PASSWORD_FILE: /run/secrets/mariadb_pass
      MARIADB_ROOT_USER: root
      MARIADB_ROOT_PASSWORD_FILE: /run/secrets/mariadb_pass_root
    volumes:
      - "/srv/bookstack/mariadb:/var/lib/mysql:rw"
    secrets:
      - "mariadb_pass"
      - "mariadb_pass_root"
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      start_period: 10s
      interval: 10s
      timeout: 5s
      retries: 3

secrets:
  bookstack_appkey:
    file: /opt/bookstack/secrets/bookstack_appkey
  mariadb_pass:
    file: /opt/bookstack/secrets/mariadb_pass
  mariadb_pass_root:
    file: /opt/bookstack/secrets/mariadb_pass_root

networks:
  traefik:
    external: true
  bookstack-network:
    external: false

Container variables:

root@d5143181c586:/# env
DB_PASSWORD=/run/secrets/mariadb_pass
PUID=1000
HOSTNAME=d5143181c586
S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
PWD=/
TZ=Europe/Amsterdam
DB_PORT=3306
HOME=/root
PGID=1000
VIRTUAL_ENV=/lsiopy
APP_KEY=/run/secrets/bookstack_appkey
S6_VERBOSITY=1
S6_STAGE2_HOOK=/init-hook
APP_URL=https://docs.domain.com:443
DB_USERNAME=dyar-bookstack-user
TERM=xterm
DB_HOST=mariadb
SHLVL=1
PS1=$(whoami)@$(hostname):$(pwd)\$
LSIO_FIRST_PARTY=true
PATH=/lsiopy/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PHP_INI_SCAN_DIR=:/config/php
DB_DATABASE=dyar-bookstack
_=/usr/bin/env
root@d5143181c586:/# env | grep /run
DB_PASSWORD=/run/secrets/mariadb_pass
APP_KEY=/run/secrets/bookstack_appkey

Verification:

root@d5143181c586:/run/secrets# ls
bookstack_appkey  mariadb_pass
root@d5143181c586:/run/secrets# cat *
<REDAC> (but its the correct secret)
<REDAC> (but its the correct secret)

Manual Login

docker exec -it bookstack-server bash
root@61a9cf98b134:/# mariadb -h mariadb -u dyar-bookstack-user -p dyar-bookstack
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 26
Server version: 12.2.2-MariaDB-ubu2404 mariadb.org binary distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [dyar-bookstack]> show tables
    -> ;
Empty set (0.001 sec)

MariaDB [dyar-bookstack]> show databases;
+--------------------+
| Database           |
+--------------------+
| dyar-bookstack     |
| information_schema |
+--------------------+
2 rows in set (0.001 sec)

Waiting for DB to be available

   Illuminate\Database\QueryException

  SQLSTATE[HY000] [1045] Access denied for user 'dyar-bookstack-user'@'172.20.0.3' (using password: YES) (Connection: mysql, Host: mariadb, Port: 3306, Database: dyar-bookstack, SQL: select exists (select 1 from information_schema.tables where table_schema = schema() and table_name = 'migrations' and table_type in ('BASE TABLE', 'SYSTEM VERSIONED')) as `exists`)

  at /app/www/vendor/laravel/framework/src/Illuminate/Database/Connection.php:838
    834▕             $exceptionType = $this->isUniqueConstraintError($e)
    835▕                 ? UniqueConstraintViolationException::class
    836▕                 : QueryException::class;
    837▕
  ➜ 838▕             throw new $exceptionType(
    839▕                 $this->getNameWithReadWriteType(),
    840▕                 $query,
    841▕                 $this->prepareBindings($bindings),
    842▕                 $e,

      +41 vendor frames

  42  /app/www/artisan:35
      Illuminate\Foundation\Console\Kernel::handle()

Also on Maria's side:

2026-03-11 13:48:19 5 [Warning] Aborted connection 5 to db: 'unconnected' user: 'unauthenticated' host: '172.20.0.3' (This connection closed normally without authentication)
2026-03-11 13:48:25 6 [Warning] Access denied for user 'dyar-bookstack-user'@'172.20.0.3' (using password: YES)
2026-03-11 13:48:25 7 [Warning] Access denied for user 'dyar-bookstack-user'@'172.20.0.3' (using password: YES)
2026-03-11 13:48:25 8 [Warning] Access denied for user 'dyar-bookstack-user'@'172.20.0.3' (using password: YES)
2026-03-11 13:48:25 9 [Warning] Access denied for user 'dyar-bookstack-user'@'172.20.0.3' (using password: YES)
2026-03-11 13:48:43 14 [Warning] Access denied for user 'dyar-bookstack-user'@'localhost' (using password: YES)
2026-03-11 13:52:33 63 [Warning] Aborted connection 63 to db: 'unconnected' user: 'unauthenticated' host: '172.20.0.3' (This connection closed normally without authentication)
2026-03-11 13:52:38 64 [Warning] Access denied for user 'dyar-bookstack-user'@'172.20.0.3' (using password: YES)
2026-03-11 13:52:38 65 [Warning] Access denied for user 'dyar-bookstack-user'@'172.20.0.3' (using password: YES)
2026-03-11 13:52:38 66 [Warning] Access denied for user 'dyar-bookstack-user'@'172.20.0.3' (using password: YES)
2026-03-11 13:52:38 67 [Warning] Access denied for user 'dyar-bookstack-user'@'172.20.0.3' (using password: YES)

[DaanSelen]

With:

   environment:
      PUID: 1000
      PGID: 1000
      TZ: Europe/Amsterdam

      APP_URL: https://docs.dyar.cloud:443
      FILE__APP_KEY: /run/secrets/bookstack_appkey

      DB_HOST: mariadb
      DB_PORT: 3306
      DB_DATABASE: dyar-bookstack
      DB_USERNAME: dyar-bookstack-user
      FILE__DB_PASSWORD: /run/secrets/mariadb_pass

It just becomes;

root@1e30b29006b9:/# env | grep FILE
FILE__DB_PASSWORD=/run/secrets/mariadb_pass
FILE__APP_KEY=/run/secrets/bookstack_appkey