Secrets

Compose makes secret delivery look settled. Declare a top-level secret, grant a service access to it, and the value appears under /run/secrets/. The interface is simple; the storage and delivery path behind it are not. Outside Swarm, a file-backed Compose secret is a bind mount. A secret sourced from the host environment follows a different path and, with current Compose versions, ends up in the container’s writable layer. Both appear under /run/secrets, but they leave different traces on the host and behave differently when someone runs docker commit. The path alone says nothing about whether the value lives in a tmpfs. ...

Stop hardcoding passwords! Docker Compose secrets provide a secure way to handle sensitive data. Basic secret setup Define secrets and use them in services: secrets: db_password: file: ./secrets/db_password.txt api_key: file: ./secrets/api_key.txt services: app: image: myapp:latest secrets: - db_password - api_key environment: DB_PASSWORD_FILE: /run/secrets/db_password API_KEY_FILE: /run/secrets/api_key Secrets appear as files in /run/secrets/ inside containers. Reading secrets in your app Node.js example: ...