Nope! I utilize env files for all of my password/privileged settings. In the command entry for docker-compose.yml, you can then use a non-templated env var (one that docker-compose itself doesn't fill) by replacing a single dollar sign with two. That then loads the credential from the environment instead of command line.