Docker Secrets

Docker Secrets is a secure way to store and manage sensitive data such as passwords, API keys, and certificates.

Docker Secrets (Swarm Mode)

# Create a secret from a file
echo "secret123" | docker secret create db_password -

# Create a secret from a command
docker secret create api_key /path/to/api_key.txt

# List secrets
docker secret ls

# Inspect a secret
docker secret inspect db_password

# Delete a secret
docker secret rm db_password

Using Secrets

# docker-compose.yml with Swarm
version: '3.8'

services:
  database:
    image: postgres:15
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    secrets:
      - db_password

  api:
    build: ./backend
    environment:
      DB_PASSWORD_FILE: /run/secrets/db_password
      API_KEY_FILE: /run/secrets/api_key
    secrets:
      - db_password
      - api_key

secrets:
  db_password:
    file: ./secrets/db_password.txt
  api_key:
    file: ./secrets/api_key.txt

Secrets Inside a Container

# The secret is available at /run/secrets/
docker exec api cat /run/secrets/db_password

# Or use an environment variable
docker exec api env | grep DB_PASSWORD

Alternative: Environment Variables

# For Docker Compose without Swarm
version: '3.8'

services:
  api:
    build: ./backend
    environment:
      - DB_PASSWORD=${DB_PASSWORD}
      - API_KEY=${API_KEY}
    env_file:
      - .env

Use Case: Application Secrets

# Create the secrets directory
mkdir -p secrets

# Create secret files
echo "super_secret_password" > secrets/db_password.txt
echo "myapp_api_key_123" > secrets/api_key.txt

# Make sure the permissions are correct
chmod 600 secrets/*.txt

# docker-compose.yml
version: '3.8'

services:
  database:
    image: postgres:15
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: admin
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    secrets:
      - db_password
    volumes:
      - db-data:/var/lib/postgresql/data

  api:
    build: ./backend
    environment:
      DB_HOST: database
      DB_NAME: myapp
      DB_USER: admin
      DB_PASSWORD_FILE: /run/secrets/db_password
      API_KEY_FILE: /run/secrets/api_key
    secrets:
      - db_password
      - api_key

secrets:
  db_password:
    file: ./secrets/db_password.txt
  api_key:
    file: ./secrets/api_key.txt

volumes:
  db-data:

Everyday Use Case

Case: A developer needs to manage secrets.

# Development: use .env
echo "DB_PASSWORD=dev123" > .env
echo "API_KEY=dev_key" >> .env

# Production: use Docker secrets
docker secret create db_password prod_db_pass.txt
docker secret create api_key prod_api_key.txt

Best Practices

1. Don't commit secrets: Use .gitignore
2. Use Docker secrets: For Swarm mode
3. Use .env: For development
4. Rotate secrets: Change secrets regularly
5. Audit access: Monitor who accesses secrets

Troubleshooting

Secret not available

# Make sure the secret has been created
docker secret ls

# Check inside the container
docker exec api ls -la /run/secrets/

# Check the environment variable
docker exec api env | grep PASSWORD

Conclusion

Docker Secrets provides a secure way to manage sensitive data. For applications, use secrets for database passwords and API keys.