Secrets in docker compose

Question

My environment is an ubuntu 18.04 VPS.

I can't get file-based secrets to work with mariadb in a docker container.

1. create docker-compose.yml:

version: '3.7'
services:
  db:
    image: mariadb:10.4.8-bionic
    environment:
      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/password_root
      - MYSQL_PASSWORD_FILE=/run/secrets/password_user
      - MYSQL_DATABASE=database
      - MYSQL_USER=admin
    secrets:
      - password_root
      - password_user
secrets:
  password_root:
    file: .secret_password_root
  password_user:
    file: .secret_password_user

2. create secrets:

echo -n secret > .secret_password_root
echo -n secret > .secret_password_user
chown root:root .secret_password*
chmod 400 .secret_password*

(Note that I can set 444, but that would expose the secrets file on the host which is a very bad idea.)

3. run:

docker-compose up

Error:

db_1 | /usr/local/bin/docker-entrypoint.sh: line 37: /run/secrets/password_root: Permission denied

According to the docs, the secrets file should be mounted as 0444, but that's obviously not happening.

Answer 1

Apparently this is not supported for "docker compose", only for "docker swarm". The docs are misleading.

Docker Compose doesn't support real (swarmkit) secrets, and imitates them by bind-mounting the file directly into the container (which means that permissions on the host are the same as in the container).

You can change the ownership of the file on the host to match the uid/gid of the user in the container, but otherwise I don't think there's much that can be done unfortunately

UPDATE 2022

If you want this functionality, please upvote this PR, and/or add some comments, so the developers know how badly we want this feature. That PR was supposed to add this feature, but was not completed.

Answer 2

Since docker-compose v2.5.0 this is now possible.

Dockerfile:

# syntax=docker/dockerfile:1.2

RUN --mount=type=secret,id=mysecret,target=/root/mysecret cat /root/mysecret

docker-compose.yml

services:
  my-app:
    build:
      context: .
      secrets:
        - mysecret

secrets:
  mysecret:
   file: ~/.npmrc

Shell:

$ docker-compose build