How to secure secrets in docker-compose setup? reddit / selfhosted ---------------------------------------------------------------------- gyzerok · 2023-10-09 15:47 Hey self-hosters! On my Raspberry Pi server I am using Docker Compose to run several containers. Some of them need secrets, for example Caddy. Currently these secrets are written in `docker-compose.yml`, but it feels wrong to store them in plain text. I found docker secret management, but it seems to require docker swarm (which I've never used and I don't feel that I need). What would be an easy way of dealing with this? What do you use? ---------------------------------------------------------------------- UnmanagedEntity · 2023-10-09 15:53 This might help: https://docs.docker.com/compose/use-secrets/ ---------------------------------------------------------------------- thekrautboy · 2023-10-09 16:10 * Docker Compose secrets * .env files * Thirdparty secrets manager ---------------------------------------------------------------------- mb2m · 2023-10-09 16:58 Secure your server and have strict file permissions on your yml file. ---------------------------------------------------------------------- trexxeon · 2023-10-09 17:08 The injection of secrets seems to be so hard to accomplish.. although this would be the best solution to just take all secrets from bitwarden secrets manager ---------------------------------------------------------------------- zoredache · 2023-10-09 17:21 > best solution to just take all secrets from ... The challenge of course, is that now you have to provide some kind of credentials to access the secrets manager. Ideally your secrets manager will provide some auditing/logging, and if you use a secret manager you only need to provide the secrets manager credential instead of the possible many secrets you might need in a complicated environment. ---------------------------------------------------------------------- zoredache · 2023-10-09 17:30 > What would be an easy way of dealing with this? What do you use? There is no foolproof way to deal with this that is easy. I manage my containers using ansible, and the secrets are in an ansible vault. But as soon as the containers are deployed the secrets that are deployed will be in the container, which means anyone with access to inspect, or access the container with `docker exec` can get them. If your secrets need to be in an environment variable in the container, then anyone with the ability to use `docker exec` or `docker inspect` can see them. So don't focus too hard about hiding their storage at rest, if people can just get the secrets via docker. Of course you can kinda avoid the 'docker inspect' issue if you remaster your images and inject one of the secrets management tools directly into the image. Then you provide the container with the credentials to lookup secrets. But someone with the ability exec might still be able to extract the secrets depending on how it is used. Anyway before focus too much on the secrets thing, consider everything else. ---------------------------------------------------------------------- schklom · 2023-10-10 01:35 > anyone with the ability to use > docker exec > or > docker inspect Unless you have Rootless Docker (I guess most don't), then anyone with this access can also access `docker` and become root anyway ---------------------------------------------------------------------- SuperbAd8035 · 2023-10-10 03:39 I control access to the files rather than focusing on what's in the files themselves. ---------------------------------------------------------------------- _StochasticParrot · 2023-10-11 11:00 1password has [1Password Connect](https://developer.1password.com/docs/connect/) ---------------------------------------------------------------------- thekrautboy · 2023-10-11 17:18 I would prefer FOSS solutions. ---------------------------------------------------------------------- bonelifer · 2023-10-12 03:51 Simple to use, https://github.com/romantomjak/env-vault/ I have a makefile I use to make it simple.