<blockquote>
  <p>Once the secret reaches a manager node, it gets saved to the internal
  Raft store, which uses NACL’s Salsa20Poly1305 with a 256-bit key to
  ensure no data is ever written to disk unencrypted. <strong>Writing to the
  internal store gives secrets the same high availability guarantees
  that the the rest of the swarm management data gets.</strong></p>
</blockquote>

<p><a href="https://blog.docker.com/2017/02/docker-secrets-management/" rel="nofollow noreferrer">https://blog.docker.com/2017/02/docker-secrets-management/</a></p>

CC BY-SA 3.0
2018-01-22T07:12:04.520Z
2018-01-22T07:12:04.520Z
Ta Mu
<p>Extending Peter Muryshkin’s answer with an significant restriction. Distributing secrets has to be adapted to a <a href="https://docs.docker.com/engine/swarm/secrets/#use-secrets-in-compose" rel="nofollow noreferrer">file-based approach</a>.</p>

<blockquote>
  <p>Note: Docker secrets do not set environment variables directly. This
  was a conscious decision, because environment variables can
  unintentionally be leaked between containers (for instance, if you use
  --link).</p>
</blockquote>

<p>Some images already support this such as <a href="https://hub.docker.com/r/_/wordpress/" rel="nofollow noreferrer">Wordpress</a> and <a href="https://hub.docker.com/_/mysql/" rel="nofollow noreferrer">MySQL</a> while others have to be updated to use this approach.</p>

CC BY-SA 3.0
2018-01-22T22:08:47.647Z
2018-01-22T22:08:47.647Z
Moritz
<p>Currently I use env and sql files so that docker compose can load secrets from there and build sql database docker instances with specific user/password. The question is, how can this be ported to docker swarm? Docker secrets seem to only provide secret files over encrypted channels, but not set environment variables or be able to configure docker builds.</p>

<docker-compose><docker-swarm>
How can secrets be distributed in a docker swarm?
Moritz
# How can secrets be distributed in a docker swarm?

(Asked by: username_0 on 2018-01-21)

Currently I use env and sql files so that docker compose can load secrets from there and build sql database docker instances with specific user/password. The question is, how can this be ported to docker swarm? Docker secrets seem to only provide secret files over encrypted channels, but not set environment variables or be able to configure docker builds.

**Tags:** docker-compose, docker-swarm


---

## 2 answers

### Answer by username_1 on 2018-01-22. Score: 2 | Accepted answer

> Once the secret reaches a manager node, it gets saved to the internal
> Raft store, which uses NACL’s Salsa20Poly1305 with a 256-bit key to
> ensure no data is ever written to disk unencrypted. **Writing to the
> internal store gives secrets the same high availability guarantees
> that the the rest of the swarm management data gets.**

<https://blog.docker.com/2017/02/docker-secrets-management/>


---

### Answer by username_0 on 2018-01-22. Score: 1

Extending Peter Muryshkin’s answer with an significant restriction. Distributing secrets has to be adapted to a [file-based approach](https://docs.docker.com/engine/swarm/secrets/#use-secrets-in-compose).

> Note: Docker secrets do not set environment variables directly. This
> was a conscious decision, because environment variables can
> unintentionally be leaked between containers (for instance, if you use
> --link).

Some images already support this such as [Wordpress](https://hub.docker.com/r/_/wordpress/) and [MySQL](https://hub.docker.com/_/mysql/) while others have to be updated to use this approach.


---

