I'm working on a system where a dockerized application must run on client side machines (Ubuntu PC), with some sensitive data that must persist between runs that we want to limit access to. In prototyping I just stored the data in the host file system and used a bind mount to map that folder into the application container.

I want to avoid situtations where someone with access to the machine can just copy out some user data, or even look at it.

Looking for some guidance on what would be a good solution in my case.

What I have read from google this sounds to be a bit of a different use case as to where user data/docker volumes are securely hidden away between the (fire)walls of server rooms and cloud instances and I haven't therefore been able to find a good solution on how to limit access to said user data so that no one (no proccess, nothing) except the running container has access to that data, even with physical access to the machine.

I am also very new to devops and deploying systems so I would appreciate any insight on how you would solve that matter! Thanks


You could save the data in a database. That database can be also a container (deploy them both with docker-compose maybe). The database is password protected and it can persist its encrypted data on the disk between runs.

Also you can use Vault (https://docs.docker.com/samples/library/vault/).

Hope this helps

  • 1
    Thanks for the answer! Databases unfortunately will not work, since the main concern of the data are a few files of couple hundred megabytes that can't be put to a database. Will vaults help us with that? Correct me if I am wrong but is a vault basically, in its essence, a password protected volume/folder? – Martin1 Apr 3 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.