Secrets: write-up best practices, do's and don'ts, roadmap

Handling secrets (passwords, keys and related) in Docker is a recurring topic. Many pull-requests have been 'hijacked' by people wanting to (mis)use a specific feature for handling secrets. So far, we only _discourage_ people to use those features, because they're either provenly insecure, or not designed for handling secrets, hence "possibly" insecure. We _don't_ offer them real alternatives, at least, not for all situations and _if_, then without a practical example. I just think "secrets" is something that has been left lingering for too long. This results in users (mis)using features that are not designed for this (with the side effect that discussions get polluted with feature requests in this area) and making them jump through hoops just to be able to work with secrets. ### Features / hacks that are (mis)used for secrets This list is probably incomplete, but worth a mention - **Environment Variables**. Probably the most used, because it's part of the ["12 factor app"](http://12factor.net). Environment variables are discouraged, because they are; - Accessible by any proces in the container, thus easily "leaked" - Preserved in intermediate layers of an image, and visible in docker inspect - Shared with any container linked to the container - **Build-time environment variables** (https://github.com/docker/docker/pull/9176, https://github.com/docker/docker/pull/15182). The build-time environment variables were **not** designed to handle secrets. By lack of other op

Posted by thaJeztah on May 26, 2015, 9:01 PM

Tags

• github (SaaS)

Related issues

• 2026 - Microsoft Office 365
• [Ubuntu] `ubuntu-latest` label will use Ubuntu 26.04 in November 2026
• Gamut mapping
• [Codex Desktop] Editing and resending a queued message triggers "App-server queued follow-up no longer exists"
• [Windows] ChatGPT 26.820.60940 fails with "invalid transport in mcp_servers.codex_app"; Beta 26.727.40816 works
• [BUG]: infinite loading of videos