Docker Compose Secrets: Keep Credentials Out of Your Code
Docker Compose Secrets inject sensitive data into containers as files at runtime, keeping credentials out of your version-controlled docker-compose.yml. Use them for API keys and passwords. The footgun: your app must read from a file, not an env var.
Why it exists
Hardcoding secrets like API keys or database passwords directly into docker-compose.yml files or Docker images is a major security risk. It exposes credentials in version control, makes them difficult to rotate, and violates the principle of separating config from code.
The mental model
Think of secrets as sealed, named envelopes containing sensitive information. You define the envelope's contents in a separate file and just tell Docker Compose which envelopes (secrets) to give to which services. The service receives the envelope at a secure, predictable location inside the container and can open it to read the contents.
How it works
You define a top-level secrets key in your docker-compose.yml. This key lists the secrets you'll use, pointing to external files that contain the actual secret values. Then, within each service definition that needs a secret, you add a secrets block to grant it access. At runtime, Docker mounts each secret as a file into the container's filesystem at /run/secrets/<secret_name>. Your application code then reads the secret from this file.
When to use it
Use secrets for any piece of data you wouldn't want to commit to a public Git repository. This includes database credentials, API keys, private certificates, and other sensitive configuration values. It's the standard mechanism for handling credentials in a Compose environment for local development and simple deployments.
When not to use it
Do not use secrets for non-sensitive configuration, like a port number or a public URL; environment variables are better for that. Also, Docker Compose secrets are not a full-blown secrets management solution like HashiCorp Vault or AWS Secrets Manager. Those tools offer advanced features like dynamic secret generation, leasing, and auditing that are necessary for more complex or high-security production environments.
One canonical example
A docker-compose.yml file defines a top-level secrets block that declares a secret named db_password and points it to a local file, ./db_password.txt. A postgres service is then granted access to this secret. Inside the service definition, an environment variable POSTGRES_PASSWORD_FILE is set to /run/secrets/db_password. This tells the official Postgres image to read its password from the file that Docker automatically mounted at that path, rather than from a less secure plain-text environment variable.
Interview question
When using Docker Compose Secrets, how does an application inside a service typically retrieve the sensitive information?
- a.It reads the secret value from an environment variable automatically set by Compose.
- b.It accesses a file mounted by Compose into a specific directory within the container.Correct
- c.It fetches the secret from a dedicated Compose secrets API endpoint.
- d.It retrieves the secret directly from the docker-compose.yml file at runtime.
Why? this is the answer
Docker Compose Secrets are mounted as files into the container's filesystem at /run/secrets/<secret_name>, which the application then reads. Option A is a common misconception; applications must read secrets from these files, not directly from environment variables, to maintain security.
Just read this? Test yourself on what you have been reading.
Read the original → docs.docker.com
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on docker — each one lists the topics its interview covers.
See open roles