Docker:Secret
lastmod 2023-08-03created 2018-08-174 edits
In terms of Docker Swarm services, a secret is a blob of data, such as a password, SSH private key, SSL certificate, or another piece of data that should not be transmitted over a network or stored unencrypted in a Dockerfile or in your application's source code. In Docker 1.13 and higher, you can use Docker secrets to centrally manage this data and securely transmit it only to those containers that need access to it. Secrets are encrypted during transit and at rest in a Docker swarm. A given secret is only accessible to those services which have been granted explicit access to it, and only while those service tasks are running.
You can use secrets to manage any sensitive data which a container needs at runtime but you don't want to store in the image or in source control, such as:
- Usernames and passwords
- TLS certificates and keys
- SSH keys
- Other important data (e.g., the name of a database or internal server)
- Generic strings or binary content (up to 500 kb in size)
How Docker manages secrets
When you grant a newly-created or running service access to a secret, the decrypted secret is mounted into the container in an in-memory filesystem. The location of the mount point within the container defaults to /run/secrets/<secret_name> in Linux containers, or C:\ProgramData\Docker\secrets in Windows containers. You can specify a custom location in Docker 17.06 and higher.