Secrets management in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Docker Secrets: Inspecting a Secret

What is the output of the command docker secret inspect my_secret if the secret my_secret exists and contains the text password123?

A Error: secret my_secret not found

B password123

C [{"ID":"<secret_id>","Version":{"Index":1},"Spec":{"Name":"my_secret","Labels":{}}}]

D [{"ID":"<secret_id>","Spec":{"Name":"my_secret","Data":"password123"}}]

💡 Hint

The inspect command shows metadata, not the secret content.

The docker secret inspect command returns metadata about the secret, such as its ID and name, but does not reveal the secret's content for security reasons.

🔀 Workflow

intermediate

Using Docker Secrets in a Service

Which of the following is the correct way to create a Docker service that uses a secret named db_password?

A docker service create --name my_service --env db_password nginx

B docker service create --name my_service --secret db_password nginx

C docker service create --name my_service --mount type=secret,source=db_password,target=db_password nginx

D docker service create --name my_service --secret-file db_password nginx

💡 Hint

Docker secrets are added with the --secret flag, not as environment variables or mounts.

To use a secret in a Docker service, you add it with the --secret flag. The secret is then available inside the container at /run/secrets/db_password.

❓ Troubleshoot

advanced

Secret Not Available Inside Container

You created a Docker secret named api_key and attached it to a service. Inside the container, the secret file /run/secrets/api_key is missing. What is the most likely cause?

A The secret content is empty, so the file is not created.

B The secret file is located at /etc/secrets/api_key instead of /run/secrets/api_key.

C Docker secrets are only available in Docker Compose, not in services.

D The secret was not attached to the service using the --secret flag.

💡 Hint

Check how the secret was added to the service.

If the secret is not attached to the service with the --secret flag, it will not be available inside the container at the expected path.

🧠 Conceptual

advanced

Security of Docker Secrets

Which statement best describes how Docker secrets are stored and accessed?

A Docker secrets are encrypted at rest and only decrypted inside the container's memory.

B Docker secrets are stored as plain text files on the host filesystem.

C Docker secrets are embedded in the container image during build time.

D Docker secrets are passed as environment variables to containers.

💡 Hint

Think about how secrets should be protected on disk and in memory.

Docker encrypts secrets at rest in the swarm and only decrypts them in the container's memory, never storing them unencrypted on disk.

✅ Best Practice

expert

Best Practice for Updating Docker Secrets

What is the recommended way to update a Docker secret named tls_cert without downtime for the service using it?

A Create a new secret with a different name, update the service to use the new secret, then remove the old secret.

B Remove the old secret, create a new secret with the same name, and update the service to use it.

C Directly edit the secret content on the host filesystem where Docker stores secrets.

D Restart the Docker daemon to reload the updated secret content.

💡 Hint

Docker secrets are immutable; think about how to switch secrets safely.

Docker secrets cannot be updated in place. The best practice is to create a new secret with a new name, update the service to use it, and then remove the old secret to avoid downtime.