DEV Community

SOVANNARO
SOVANNARO

Posted on

🔐 Using Secrets with Swarm Stacks

Secure your sensitive data like a pro in Docker Swarm

Managing passwords, API keys, and database credentials in your applications is no joke. Accidentally leaking them can cause serious headaches. 😖 Thankfully, Docker Swarm gives us a built-in, secure way to manage this kind of data — Secrets.

In this article, you'll learn:

  • What Docker Secrets are
  • Why you should use them
  • How to use them with Swarm Stacks
  • Real-life example to follow along

Let’s dive in! 🏊‍♂️

💡 What Are Docker Secrets?

Docker Secrets are encrypted blobs of sensitive data like:

  • Passwords
  • API tokens
  • TLS certificates
  • SSH private keys

Instead of hardcoding these into your Dockerfile, docker-compose.yml, or environment variables, secrets let you inject them into containers only when and where needed, and in a secure way.

🚫 Why Not Just Use ENV Vars?

Using environment variables for credentials is risky, because:

  • They show up in docker inspect
  • They might end up in logs
  • They're easily exposed if someone gets access to the container

Secrets solve this by:
✅ Storing values encrypted
✅ Mounting them as temporary, read-only files
✅ Not being passed as environment variables

🛠 Setting Up Secrets in a Swarm Stack

To use secrets with a Docker Swarm Stack, follow these simple steps.

1. 🧪 Create a Secret

You must be in Swarm mode:

docker swarm init
Enter fullscreen mode Exit fullscreen mode

Now, create your secret:

echo "mysecretpassword" | docker secret create db_password -
Enter fullscreen mode Exit fullscreen mode

This creates a secret named db_password.

📝 You can also create it from a file:

docker secret create db_password ./db_pass.txt

2. 📦 Add Secret to Your Stack File

Let’s say you're deploying a stack using docker-compose.yml. Here's how to include the secret:

version: '3.8'

services:
  app:
    image: my-app:latest
    secrets:
      - db_password
    environment:
      - DB_USER=admin
      - DB_PASSWORD_FILE=/run/secrets/db_password

secrets:
  db_password:
    external: true
Enter fullscreen mode Exit fullscreen mode

✅ In the container, Docker mounts the secret to /run/secrets/db_password.
✅ You can use the _FILE environment pattern to read it in your app.

3. 🚀 Deploy the Stack

Now deploy it:

docker stack deploy -c docker-compose.yml my_stack
Enter fullscreen mode Exit fullscreen mode

You can verify the secret is mounted:

docker service ps my_stack_app
Enter fullscreen mode Exit fullscreen mode

Inside the container:

docker exec -it <container_id> cat /run/secrets/db_password
Enter fullscreen mode Exit fullscreen mode

🧼 Clean Up

When you’re done, you can remove the secret:

docker secret rm db_password
Enter fullscreen mode Exit fullscreen mode

🔐 Real-World Use Case: Secure Database Connection

Imagine your app needs to connect to a PostgreSQL database. Instead of this:

environment:
  - POSTGRES_PASSWORD=mysecret
Enter fullscreen mode Exit fullscreen mode

Use secrets:

secrets:
  - pg_password
environment:
  - POSTGRES_PASSWORD_FILE=/run/secrets/pg_password
Enter fullscreen mode Exit fullscreen mode

Your app reads the file and uses the password securely — no leaks in logs, no exposure in docker inspect.

🎉 Wrap Up

Docker Secrets + Swarm Stacks = ❤️
They help you:

  • Avoid leaking credentials
  • Follow best security practices
  • Sleep better at night 😴

TL;DR

Feature Env Vars ❌ Secrets ✅
Encrypted No Yes
Shown in logs Yes No
Secure access No Yes
Easy to rotate Hard Easier

Start using secrets in your Swarm stacks today and give your apps the protection they deserve!

If you enjoyed this article or have questions, feel free to reach out or comment below. 💬
Happy (and safe) shipping! 🚢🔐

Top comments (0)