You can pass it as a file using docker secrets (#225). You can also just supply a hashed password:

If the presented password string is already in MD5-encrypted format, then it is stored encrypted as-is

- https://stackoverflow.com/a/17431573

@yosifkit Thanks for the info. This helps a lot.
Is there a way to remove vars required only for initial container setup?

Thanks @tianon . Closing the issue.

@tianon

Unfortunately, only by saving the content in a volume and recreating the
container after the initial setup without the variables (which is how we
usually recommend folks handle this particular case).

I just had the opportunity to try this (using pg10 beta 3) and while the cluster starts fine, I can no longer connect to it with the same password :(

It sounds like you would actually need to edit the metadata of a docker image. In that case you could take an advantage of useing docker-copyedit.