Docker and Ansible Vault: An insecure match?

[Mahmoud Saada]

Ansible Vault requires to prompt the user for a password or a file containing the password. But if I'm running Ansible inside of a container, I cannot prompt the user for a password.

How can I run a playbook using vars encrypted by Vault during a Docker build?
How can I do it without exposing a password file?
Is there a best practice?

[Paul Tötterman]

How can I run a playbook using vars encrypted by Vault during a Docker build?

Don't
 

How can I do it without exposing a password file?
Is there a best practice?

Give sensitive information to the docker container as environment values. See e.g.  https://registry.hub.docker.com/_/postgres/ and POSTGRES_PASSWORD

Cheers,
Paul