5

I am using docker-compose to create 5 containers that run my application. Two containers need credentials retrieve from Azure Key Vault (web.config passwords to access 3rd party service).

As I am committing this to a public repo I do not want to store any azure credentials in plain text in the docker-compose.yaml file when starting up each container.

Is there a better way to do this?

I am thinking to use https://github.com/mariotoffia/FluentDocker to grab the secrets and dynamically create each container - but wonder if there is a better way?

Can I use Azure Key Vault with Docker?

Is it easier to use Docker secrets?

Or something else?

Improve this question
1
  • 1
    Do not follow the OP's answer to this question. Using environment variables to pass secrets is very bad practice! Instead use Docker Secrets. Docker Secrets securely passes and stores secrets to your Docker Container.
    – D.O.
    Commented Feb 20, 2020 at 8:22

1 Answer 1

Reset to default
3

Found this --> Passing secrets to a Docker container

Environment variables appear the preferred method - will need to run a prebuild script to fetch the secrets and then follow this

https://docs.docker.com/compose/environment-variables/

@Mods feel free to close as a duplicate

Improve this answer
1
  • 1
    In addition, try to run containers in a virtual network (see here), then configure your key vault to restrict access to the vnet where the containers run. This way even if someone steals access credentials for key vault, the person would need to compromise more in order to extract secrets.
    – fernacolo
    Commented Sep 1, 2018 at 0:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.