Securing Sensitive Data with Docker Secrets

Securing Sensitive Data with Docker Secrets

In this lesson, you will learn how to protect sensitive credentials by mounting them directly into a container's filesystem as encrypted files, preventing them from leaking into logs or environment variables.

The Problem with Environment Variables

Previously, we discussed managing configuration via environment variables. While convenient, environment variables have a security flaw: they are often logged by container runtimes, visible in process lists, and inherited by child processes. If you pass a database password or API key through an environment variable, it is essentially "plaintext" to anyone who can inspect your container's metadata.

Mounting Secrets Securely

Docker Secrets solve this by providing a secure way to inject sensitive data. Instead of passing the data as a variable, Docker encrypts the secret at rest and mounts it as a temporary, in-memory file inside the container, typically at /run/secrets/. Because this is an in-memory filesystem (tmpfs), the secret never touches the host's disk in plaintext and is not visible in your process environment logs.

To use this in a Compose file, you define the secret and then reference it in your service:

services:
  web-app:
    image: my-app
    secrets:
      - db_password

secrets:
  db_password:
    file: ./secrets/db_password.txt

When your application starts, it doesn't look for an environment variable. Instead, it simply reads the file located at /run/secrets/db_password.

Best Practices for Your Application

Your application code should be written to look for secrets in this specific directory. This is a common pattern in cloud-native development:

1. Check for a file at /run/secrets/db_password.
2. If found, read the contents as the password.
3. If not found, fall back to a configuration file or environment variable (only for local development).

By mounting secrets as files, you ensure that the sensitive data stays isolated within the container's isolated memory space, significantly reducing the attack surface compared to standard environment variables.

Key Takeaway: Docker Secrets move sensitive data out of vulnerable environment variables and into encrypted, in-memory filesystem mounts, ensuring credentials are never exposed in container metadata or logs.