I'm new to Docker and want to put my Django web application into containers.
For the last couple days I'm struggling with passing credentials safe to containers.
Online there is always the hint that secrets should not be passed as environment variable because they can be retrieved via inspect or from the images. My hope is that it can be neglected for my setup.
I provide the credentials via .env file of docker compose. This file is not on version control.
The containers are running as non-elevanted users (a different special user).
Docker command on the host can be used as root only.
I'm the only user of the host server (Ubuntu 18.04).
I assume breaking into the host is much harder (I'm using SSH public key authentication with non-root user only) than breaking into container of the Django app.
I don't want to use kubernetes or swarm.
I'm newbie to Docker and not a security expert. Do I have overlooked something? Why should I care about the docker inspect or images in this setup?
Thank you in advance