Docker environment variable security

Question

I have a docker application that I need to pass a secure piece of information to, since it uses a passphrase to encrypt/decrypt stored data. I'm trying to figure out how safe it is to use an environment variable to pass in this information. I know that if I use

docker run -e passphrase="secretkey123" --name containername imagename

Then the value can be found by:

docker inspect containername

Thus it must be stored somewhere on disk (in /var/lib/docker I assume). Is there any more secure way to pass an environment variable to docker? Should I use a temporary file in a volume linked to the host filesystem instead? Is there a better way?

Answer 1

Regardless of where it is stored, it is clearly accessible via "docker inspect". I think it boils down to how secure you want it to be. For example, you can instead have a shared volume with file permissions to restrict access to a password file on disk. Or you could have a socker/ssh/etc to avoid putting the password into a file on disk at all. It just depends on how secure you really want to be.

I do note that if you have say a web server running in a container, I assume if someone breaks out of the web server they can only access what the container can access (and not the host OS where docker is running).