You realize that docker compose has passwords in it right? It's just to easily test stuff (and maybe to copy and template off of)

It's possible to pass environment variables from the shell into the docker-compose file, so you can totally keep credentials out of that file.