Currently passwords are stored in env variable RELAYHOST_PASSWORDMAP.
So I think it would be nice if the container either asks for RELAYHOST_PASSWORDMAP or RELAYHOST_PASSWORDMAP_FILE. Then I could set RELAYHOST_PASSWORDMAP_FILE=/run/secrets/relay-password and the container could make sure that postmap is called on that file.