Docker: how to provide secret information to the container?

Question

I have my app inside a container and it's reading environment variables for passwords and API keys to access services. If I run the app on my machine (not inside docker), I just export SERVICE_KEY='wefhsuidfhda98' and the app can use it.

What's the standard approach to this? I was thinking of having a secret file which would get added to the server with export commands and then run a source on that file.

I'm using docker & fig.

Answer 1

The solution I settled on was the following: save the environment variables in a secret file and pass those on to the container using fig.

• have a secret_env file with secret info, e.g.

  export GEO_BING_SERVICE_KEY='98hfaidfaf'
  export JIRA_PASSWORD='asdf8jriadf9'
  

• have secret_env in my .gitignore

• have a secret_env.template file for developers, e.g.

  export GEO_BING_SERVICE_KEY=''  # can leave empty if you wish
  export JIRA_PASSWORD=''  # write your pass
  

• in my fig.yml I send the variables through:

  environment:
   - GEO_BING_SERVICE_KEY
   - JIRA_PASSWORD
  

• call source secret_env before building