How to remove passwords from DockerCompose.yml environment variables?

Question

git

There is docker-compose.yml and it contains Env variables with passwords for the mysql database in this container. docker-compose.yml itself is in git. Accordingly, if git is compromised, then the entire production will be compromised. how to make it so that the password does not have to be stored in git the first thing that comes to mind is some kind of script in the entrypoint that will take it from another place. but again, how it works will be and, accordingly, it will be possible to repeat it manually.

Answer 1

if environment variables from a file to cling?

env_file:
        - .env