In this lesson, you will learn how to keep sensitive information like database passwords and API keys out of your configuration files by using Docker Secrets.
The Problem with Environment Variables
Previously, we managed application configurations using environment variables. While convenient, this approach has a major security flaw: secrets defined as environment variables are often visible to any process inside the container, and they frequently end up accidentally committed to version control systems like Git when included in docker-compose.yml files.
Introducing Docker Secrets
A "Secret" is a blob of data, such as a password, SSH private key, or TLS certificate, that should not be stored unencrypted in your source code or image definitions. When you use Docker Secrets, Docker stores these values in an encrypted state.
Instead of passing the secret as a plain-text variable, Docker injects the secret into the container as a file located at /run/secrets/<secret_name>. Because this is a memory-backed file, the sensitive data never touches the disk in plain text.
Implementation Example
To implement this in your docker-compose.yml, you define the secret at the top level and then grant access to specific services:
services:
database:
image: postgres
secrets:
- db_password
secrets:
db_password:
file: ./my_secret_password.txt
In this example, the database service can read its password from the file /run/secrets/db_password. If your application code is written to look for credentials in that specific path, it can securely retrieve the password without it ever being printed in logs or defined in your orchestration files.
This separation of concerns ensures that your infrastructure definitions stay clean, while your sensitive credentials remain isolated from the container's environment configuration. By mounting secrets as files rather than injecting them as environment variables, you significantly reduce the risk of secret leakage.
Key Takeaway: Use Docker Secrets to mount sensitive credentials as encrypted, memory-mapped files inside your containers instead of exposing them through plain-text environment variables.