I'm working on a system where a dockerized application must run on client side machines (Ubuntu PC), with some sensitive data that must persist between runs that we want to limit access to. In prototyping I just stored the data in the host file system and used a bind mount to map that folder into the application container.
I want to avoid situtations where someone with access to the machine can just copy out some user data, or even look at it.
What would be a good solution in my case?
What I have read from google this sounds to be a bit of a different use case as to where user data/docker volumes are securely hidden away between the (fire)walls of server rooms and cloud instances and I haven't therefore been able to find a good solution on how to limit access to said user data so that no one (no proccess, nothing) except the running container has access to that data, even with physical access to the machine.
I am also very new to DevOps and deploying systems so I would appreciate any insight on how to solve that matter!