3

I am using docker-compose to create 5 containers that run my application. Two containers need credentials retrieve from Azure Key Vault (web.config passwords to access 3rd party service).

As I am committing this to a public repo I do not want to store any azure credentials in plain text in the docker-compose.yaml file when starting up each container.

Is there a better way to do this?

I am thinking to use https://github.com/mariotoffia/FluentDocker to grab the secrets and dynamically create each container - but wonder if there is a better way?

Can I use Azure Key Vault with Docker?

Is it easier to use Docker secrets?

Or something else?

2

Found this --> Passing secrets to a Docker container

Environment variables appear the preferred method - will need to run a prebuild script to fetch the secrets and then follow this

https://docs.docker.com/compose/environment-variables/

@Mods feel free to close as a duplicate

  • 1
    In addition, try to run containers in a virtual network (see here), then configure your key vault to restrict access to the vnet where the containers run. This way even if someone steals access credentials for key vault, the person would need to compromise more in order to extract secrets. – fernacolo Sep 1 '18 at 0:19

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.