Secrets management in Docker - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is secrets management in Docker?

Secrets management in Docker is a way to securely store and manage sensitive data like passwords, API keys, and certificates so they are not exposed in your application code or Docker images.

beginner

How do you create a secret in Docker?

You create a secret in Docker using the command:

docker secret create <secret_name> <file_with_secret>

This stores the secret securely in the Docker swarm.

intermediate

How can a Docker service access a secret?

When you deploy a Docker service, you can attach secrets to it using the --secret flag. Inside the container, the secret is available as a file in /run/secrets/<secret_name>.

beginner

Why should secrets not be stored in Docker images or environment variables?

Storing secrets in images or environment variables risks exposing them because images can be shared and environment variables can be viewed by other processes or users. Docker secrets keep them encrypted and only available to authorized services.

intermediate

What happens to Docker secrets when a service is removed?

When a Docker service is removed, the secrets attached to it are no longer accessible by that service. Docker manages secrets lifecycle so they are only available to running services that need them.

Which command creates a Docker secret?

A docker secret create my_secret secret.txt

B docker create secret my_secret secret.txt

C docker secret add my_secret secret.txt

D docker secret new my_secret secret.txt

The correct syntax to create a secret is 'docker secret create <name> <file>'.

Where are Docker secrets available inside a container?

A /run/secrets/

B /etc/secrets/

C /var/lib/secrets/

D /usr/local/secrets/

Docker mounts secrets as files inside the container at /run/secrets/<secret_name>.

Why is it unsafe to store secrets in environment variables?

A They are encrypted automatically

B They can be viewed by other processes or users

C They are only accessible inside the container

D They expire after service removal

Environment variables can be exposed to other processes or users, risking secret leaks.

How do you attach a secret to a Docker service?

A Set the secret as an environment variable

B Add the secret to the Dockerfile

C Mount the secret as a volume

D Use the --secret flag during service creation

Secrets are attached to services using the --secret flag when creating or updating the service.

What happens to secrets when a Docker service is removed?

A Secrets are deleted from Docker swarm

B Secrets remain accessible to all containers

C Secrets are no longer accessible by that service

D Secrets are stored in environment variables

Secrets are only accessible to running services that have them attached; removing the service revokes access.

Explain how Docker secrets help keep sensitive data safe in your applications.

Think about how secrets avoid exposure compared to environment variables or image layers.

Describe the steps to create a secret and use it in a Docker service.

Start from creating the secret file, then how to add it to a service, and finally how the service reads it.