I did a little experiment to confirm that the password wasn't being set, but apparently it is actually being set. I don't know why I'm getting that warning message though.

The experimient:

const { Client } = pg;
const client = new Client({
  user: 'root',
  password: 'root',
  database: 'qr_orders_db',
});
await client.connect();

Apparently this doesn't throw errors when .env.local is loaded before .env in the docker compose file. Mysteries of life I guess ¯_(ツ)_/¯.

I won't mark my own answer as the accepted one for now because I want to see if someone knows how to get rid of that warning.