Secrets management in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Docker Secrets: Inspecting a Secret

What is the output of the command docker secret inspect my_secret if the secret my_secret exists and contains the text password123?

A Error: secret my_secret not found

B password123

C [{"ID":"<secret_id>","Version":{"Index":1},"Spec":{"Name":"my_secret","Labels":{}}}]

D [{"ID":"<secret_id>","Spec":{"Name":"my_secret","Data":"password123"}}]

💡 Hint

The inspect command shows metadata, not the secret content.

The docker secret inspect command returns metadata about the secret, such as its ID and name, but does not reveal the secret's content for security reasons.

🔀 Workflow

intermediate

Using Docker Secrets in a Service

Which of the following is the correct way to create a Docker service that uses a secret named db_password?

A docker service create --name my_service --env db_password nginx

B docker service create --name my_service --secret db_password nginx

C docker service create --name my_service --mount type=secret,source=db_password,target=db_password nginx

D docker service create --name my_service --secret-file db_password nginx

💡 Hint

Docker secrets are added with the --secret flag, not as environment variables or mounts.

To use a secret in a Docker service, you add it with the --secret flag. The secret is then available inside the container at /run/secrets/db_password.

❓ Troubleshoot

advanced

Secret Not Available Inside Container

You created a Docker secret named api_key and attached it to a service. Inside the container, the secret file /run/secrets/api_key is missing. What is the most likely cause?

A The secret content is empty, so the file is not created.

B The secret file is located at /etc/secrets/api_key instead of /run/secrets/api_key.

C Docker secrets are only available in Docker Compose, not in services.

D The secret was not attached to the service using the --secret flag.

💡 Hint

Check how the secret was added to the service.

If the secret is not attached to the service with the --secret flag, it will not be available inside the container at the expected path.

🧠 Conceptual

advanced

Security of Docker Secrets

Which statement best describes how Docker secrets are stored and accessed?

A Docker secrets are encrypted at rest and only decrypted inside the container's memory.

B Docker secrets are stored as plain text files on the host filesystem.

C Docker secrets are embedded in the container image during build time.

D Docker secrets are passed as environment variables to containers.

💡 Hint

Think about how secrets should be protected on disk and in memory.

Docker encrypts secrets at rest in the swarm and only decrypts them in the container's memory, never storing them unencrypted on disk.

✅ Best Practice

expert

Best Practice for Updating Docker Secrets

What is the recommended way to update a Docker secret named tls_cert without downtime for the service using it?

A Create a new secret with a different name, update the service to use the new secret, then remove the old secret.

B Remove the old secret, create a new secret with the same name, and update the service to use it.

C Directly edit the secret content on the host filesystem where Docker stores secrets.

D Restart the Docker daemon to reload the updated secret content.

💡 Hint

Docker secrets are immutable; think about how to switch secrets safely.

Docker secrets cannot be updated in place. The best practice is to create a new secret with a new name, update the service to use it, and then remove the old secret to avoid downtime.

Practice

1. What is the main purpose of using docker secrets in a Docker environment?

easy

A. To securely store sensitive data like passwords outside of Docker images

B. To speed up container startup time

C. To increase the size of Docker images

D. To manage container networking settings

Solution

1. Step 1: Understand what secrets are

   Secrets are sensitive data such as passwords or keys that should not be stored inside images or code.

2. Step 2: Identify the purpose of Docker secrets

   Docker secrets provide a secure way to store and manage this sensitive data outside of images, making it available only to authorized services.

3. Final Answer:

   To securely store sensitive data like passwords outside of Docker images -> Option A

4. Quick Check:

   Secrets = Secure sensitive data storage [OK]

Hint: Secrets keep passwords safe outside images [OK]

Common Mistakes:

• Thinking secrets speed up containers
• Confusing secrets with networking
• Assuming secrets increase image size

2. Which of the following commands correctly creates a Docker secret named db_password from a file password.txt?

easy

A. docker secret create db_password password.txt

B. docker secret add db_password password.txt

C. docker secret new db_password password.txt

D. docker secret generate db_password password.txt

Solution

1. Step 1: Recall Docker secret creation syntax

   The correct command to create a secret is docker secret create [name] [file].

2. Step 2: Match the command with options

   docker secret create db_password password.txt matches the correct syntax exactly.

3. Final Answer:

   docker secret create db_password password.txt -> Option A

4. Quick Check:

   docker secret create = correct syntax [OK]

Hint: Use 'docker secret create' to add secrets from files [OK]

Common Mistakes:

• Using 'add' instead of 'create'
• Using 'new' or 'generate' which are invalid
• Confusing secret commands with service commands

3. Given the following Docker service creation command:

docker service create --name myapp --secret db_password nginx

What happens to the secret db_password inside the running container?

medium

A. It is stored as an environment variable named DB_PASSWORD

B. It is printed in the container logs

C. It is mounted as a file in /run/secrets/db_password

D. It is embedded inside the container image

Solution

1. Step 1: Understand how Docker secrets are exposed

   Docker secrets are mounted as files inside the container at /run/secrets/[secret_name].

2. Step 2: Analyze the options

   It is mounted as a file in /run/secrets/db_password correctly states the secret is mounted as a file. Options A, B, and D are incorrect because secrets are not environment variables, not printed in logs, and not embedded in images.

3. Final Answer:

   It is mounted as a file in /run/secrets/db_password -> Option C

4. Quick Check:

   Secrets = files in /run/secrets [OK]

Hint: Secrets appear as files in /run/secrets inside containers [OK]

Common Mistakes:

• Thinking secrets become environment variables automatically
• Expecting secrets to be logged
• Assuming secrets are inside the image

4. You run docker secret create mysecret secret.txt but get an error: Error: secret file secret.txt not found. What is the most likely cause?

medium

A. The secret already exists

B. The file secret.txt does not exist in the current directory

C. Docker daemon is not running

D. You used the wrong secret name

Solution

1. Step 1: Understand the error message

   The error says the file secret.txt was not found, meaning Docker cannot locate the file to create the secret.

2. Step 2: Identify the cause

   This usually means the file is missing or the path is incorrect. The file secret.txt does not exist in the current directory matches this cause. Other options do not relate to file not found errors.

3. Final Answer:

   The file secret.txt does not exist in the current directory -> Option B

4. Quick Check:

   File missing = secret create error [OK]

Hint: Check file path exists before creating secret [OK]

Common Mistakes:

• Assuming secret name causes file error
• Ignoring Docker daemon status
• Thinking secret existence causes file not found

5. You want to update a secret api_key used by a running Docker service webapp. Which sequence of commands correctly updates the secret without downtime?

hard

A. Edit the secret file inside the running container

B. Directly overwrite the existing secret with docker secret update

C. Stop the service, delete the secret, create new secret with same name, then start service

D. Create new secret with a different name, update service to use new secret, then remove old secret

Solution

1. Step 1: Understand Docker secret immutability

   Docker secrets cannot be updated directly; they are immutable once created.

2. Step 2: Update secret safely

   The recommended way is to create a new secret with a new name, update the service to use this new secret, then remove the old secret to avoid downtime.

3. Step 3: Analyze options

   Create new secret with a different name, update service to use new secret, then remove old secret follows this process. Directly overwrite the existing secret with docker secret update is invalid because docker secret update does not exist. Stop the service, delete the secret, create new secret with same name, then start service causes downtime. Edit the secret file inside the running container is impossible because secrets are mounted read-only.

4. Final Answer:

   Create new secret with a different name, update service to use new secret, then remove old secret -> Option D

5. Quick Check:

   Secrets immutable = create new and update service [OK]

Hint: Create new secret and update service to avoid downtime [OK]

Common Mistakes:

• Trying to overwrite existing secret
• Stopping service causing downtime
• Editing secrets inside container