Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
Currently we im a running application on a single docker container, the application needs all sorts of sensitive data to be passed as environments variables,
Im putting those on the run command so they don't end up in the image and then on a repository, however i end up with a very non-secure run command,
Now, i understand that docker secrets exist, however, how can i use them without deploying a cluster? or is there any other way to secure this data?
Best Regards,
You can't... It does not support secrets without Swarm. Unless ''may be'' you ''Swarm'' using only one node.
The other solution would be, I think to use a third party vault software like this one:
But then, to use the secrets in your containers from Vault, you would need to read the doc.
Hope this bring you to the right path to start.
build-args are not included in the final image, but can only be accessed during image build time. A suitable solution is to write the secrets to files on the host (with appropriate permissions, of course) then volume mount them into your docker container. Your application inside the container can then read the secrets from those files
Yes, you can use secrets if you use a compose file. (You don't need to run a swarm).
You use a compose file with docker-compose: there is documentation for "secrets" in a docker-compose.yml file.
I switched to docker-compose because I wanted to use secrets. I am happy I did, it seems much more clean. Each service maps to a container. And if you ever want to switch to running a swarm instead, you are basically already there.
Note: Secrets are not loaded into the container's environment, they are mounted to /run/secrets/
Here is a example:
1) Project Structure:
|
|--- docker-compose.yml
|--- super_duper_secret.txt
2) docker-compose.yml contents:
version: "3.6"
services:
my_service:
image: centos:7
entrypoint: "cat /run/secrets/my_secret"
secrets:
- my_secret
secrets:
my_secret:
file: ./super_duper_secret.txt
3) super_duper_secret.txt contents:
Whatever you want to write for a secret really.
4) Run this command from the project's root to see that the container does have access to your secret, (Docker must be running and docker-compose installed):
docker-compose up --build my_service
You should see your container output your secret.
docker-compose using a secret? The documentation and my understanding of the implementation indicate that the secret will not be configured in the container.
No Currently Docker doesn't support config & secrets if you're not in a swarm
But the docker compose specs have configs & secrets compose specs
It actually create a docker volume to make you believe the functionality is here, more concretely it's a Bind mount
That's a big difference with swarm if you want to deploy your app remotely!
example
services:
test:
image: alpine
secrets:
- source: my_secret
secrets:
my_secret:
file: $PWD/secret
is relatively identical to this
services:
test:
image: alpine
volumes:
- $PWD/secret:/run/secrets/my_secret:ro
If you're looking at your volumes with docker inspect <container> if and you're using secret you will see that your secrets are just local bind volumes
