How do you use Docker secrets in a non-Swarm environment?

In the Docker ecosystem, Docker Secrets are primarily designed to securely manage sensitive data in Swarm mode. However, in non-Swarm environments, such as a single Docker host or when using Docker Compose, direct support for Docker Secrets is not available. Nevertheless, there are methods to emulate Docker Secrets' functionality to ensure the security of sensitive information. The following are some approaches for using Docker Secrets in non-Swarm environments:

1. Using Environment Variables

Although storing sensitive information via environment variables is not the most secure method (as they may be logged or leaked through other channels), it is the simplest approach. You can pass environment variables when running containers via the command line, for example:

bash
docker run -e MYSQL_PASSWORD='mysecretpassword' mymysqlimage

2. Docker Compose and .env Files

When using Docker Compose, manage environment variables through .env files instead of hardcoding them directly in the docker-compose.yml file. Ensure the .env file is added to .gitignore to prevent accidental commits to version control.

docker-compose.yml example:

yaml
version: '3'
services:
  myservice:
    image: myimage
    env_file:
      - .env

.env file example:

shell
MYSQL_PASSWORD=mysecretpassword

3. Using Docker Secret Management Tools

Third-party tools like HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault can securely manage secrets in Docker environments. These tools offer advanced features such as automatic secret rotation, auditing, and access control.

For instance, with HashiCorp Vault, you can access secret information from within the container without it ever appearing in plain text in configuration files or code.

4. Using Mounted Volumes to Store Secret Files

Store sensitive information in a secure host location and mount it into the container at a specified path when starting the container. This allows the application to read secrets directly from the file system without passing them as environment variables.

Docker command example:

bash
docker run -d 
  --name myapp 
  -v /path/to/secrets:/path/in/container:ro 
  myimage

This method is relatively secure because the file is mounted only when needed, and it can be set to read-only.

Conclusion

Although Docker lacks built-in Secrets management functionality in non-Swarm environments, the above methods effectively manage and protect sensitive data. The choice of method depends on specific use cases and security requirements. For highly sensitive information, it is recommended to use professional secret management tools to provide stronger security guarantees.