Docker secrets within a docker volume

Question

I am trying to setup a Docker-based Jenkins instance. Essentially, I run the jenkins/jenkins:lts image as a container and mount a data volume to persist the data Jenkins will create.

Now, what I would like to do is share the host's ssh keys with this Jenkins instance. It's probably due to my limited Docker knowledge, but my problem is I don't know how I can mount additional files/directories to my volume and Jenkins requires that I put ssh keys within var/jenkins_home/.ssh.

I tried naively creating the directories in Dockerfile and then mounting them with docker-compose. It failed, as you might expect, since the volume is the one containing Jenkins' home directory data, not the Jenkins container itself.

I have the following docker-compose.yml (not working, for the reasons mentioned above):

version: '3.1'

services:
  jenkins:
    restart: always
    build: ./jenkins
    environment:
      VIRTUAL_HOST: ${NGINX_VIRTUAL_HOST}
      VIRTUAL_PORT: 8080
      JAVA_OPTS: -Djenkins.install.runSetupWizard=false
      TZ: America/New_York
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - jenkins_data:/var/jenkins_home
    networks:
      - web
      - proxy
    healthcheck:
      test: ["CMD", "curl --fail http://${NGINX_VIRTUAL_HOST}/ || exit 1"]
      interval: 1m
      timeout: 10s
      retries: 3
    secrets:
      - host_ssh_key

volumes:
  jenkins_data:

networks:
  web:
    driver: bridge
  proxy:
    external:
      name: nginx-proxy

secrets:
  host_ssh_key:
    file: ~/.ssh/id_rsa

My question is: is there anyway I could get this secret within my data volume?

Answer 1

I know this is a fairly old thread but a lot of people get stuck on this including me and the answer is simply not true. You can indeed use secrets with docker-compose without using Swarm provided it's a local machine or the secrets file is mounted on the host. Not saying this is secure or desirable, just that it can be done. One of the best explanations of the several ways this is possible is this blog;

Using Docker Secrets during Development

Below is an example of parts of a docker compose file used to add an api key to a Spring application. The key are then available at /run/secrets/captcha-api-key inside the Docker container. Docker compose "fakes" it by literally binding the file as a mount which then can be accessed in whatever way. It's not secure as in the file is still there, visible to all with access to /run/secrets but it's definitely doable as a work-around. Great for dev servers but would not do it in production though;

version: '3.6'
services:
  myapp:
    image: mmyapp
    restart: always
    secrets:
      - captcha-api-key

secrets:
  captcha-api-key:
    file: ./captcha_api_key.txt

EDIT: Besides that, one can simply just run a one-node swarm which is just a tiny bit more on the resources and use secrets the way they are intended. Provided the images are already built, "docker stack deploy mydocker-composefile.yml mystackname" will do mostly the same as old docker compose did. Note though that the yml file must be written in 3 or higher specification.

Here is a short but concise write-up on compose vs swarm; The Difference Between Docker Compose And Docker Stack