Search code examples
dockerfig

Docker: how to provide secret information to the container?

I have my app inside a container and it's reading environment variables for passwords and API keys to access services. If I run the app on my machine (not inside docker), I just export SERVICE_KEY='wefhsuidfhda98' and the app can use it.

What's the standard approach to this? I was thinking of having a secret file which would get added to the server with export commands and then run a source on that file.

I'm using docker & fig.

Solution

  • The solution I settled on was the following: save the environment variables in a secret file and pass those on to the container using fig.

    • have a secret_env file with secret info, e.g.

      export GEO_BING_SERVICE_KEY='98hfaidfaf'
export JIRA_PASSWORD='asdf8jriadf9'
    • have secret_env in my .gitignore

    • have a secret_env.template file for developers, e.g.

      export GEO_BING_SERVICE_KEY=''  # can leave empty if you wish
export JIRA_PASSWORD=''  # write your pass

    • in my fig.yml I send the variables through:

      environment:
 - GEO_BING_SERVICE_KEY
 - JIRA_PASSWORD
    • call source secret_env before building