Docker Secrets

Most applications leverage sensitive data such as passwords, certificates, and SSH keys. Fortunately, Docker lets you wrap them inside secrets to keep them secure.

Note: Secrets only work in swarm mode as they leverage the cluster store.

Docker secret management

Behind the scenes, Docker encrypts secrets when they’re at rest in the cluster store and while they’re in flight on the network. It also uses in-memory filesystems to mount secrets into containers and operates a least-privilege model, where secrets are only available to services that have been explicitly granted access. There’s even a docker secret command.

The figure below shows the high-level workflow of creating a secret and deploying it to service replicas: