The password exists before the node does
Elastic's docker run start generates the elastic password and prints it once in the terminal. Miss it and you reset it from inside the container. Here the password is written in before first boot, so the node never runs without it.