<p>There is probably a better way if you are working with Google Cloud Run.  I have not tried this but I see that they have &quot;Secret Manager&quot; that you can use.  They also mention a project Berglas that can be used to store secrets in GCS cloud storage.</p>
<p>In my personal experience, it find it best to leverage widely adopted solutions and avoid creating a unique solution for security.  Getting it right is non trivial and it is less code you have to support.</p>
<p>This FAQ has doc links to the solutions I mentioned.  <a href="https://github.com/ahmetb/cloud-run-faq#how-to-configure-secrets-for-cloud-run-applications" rel="nofollow noreferrer">https://github.com/ahmetb/cloud-run-faq#how-to-configure-secrets-for-cloud-run-applications</a></p>

CC BY-SA 4.0
2020-12-31T01:25:06.837Z
2020-12-31T01:25:06.837Z
sig9
<p>I am looking for a way to provide secrets to a container running on Google Cloud Run responding to the following criteria:</p>
<ul>
<li>secure</li>
<li>centralized &amp; pulled based</li>
<li>free</li>
<li>simple</li>
<li>working with a team, with various trust scopes</li>
<li>host agnostic: changing 1 config will be the same on aws, gcp, azure</li>
</ul>
<p>When starting a new project with containers, I always come to the point where I need to manage secrets, and I often find it difficult.  <strong>My current solution</strong> is to store my secrets encrypted on a public git repository, and decrypt them inside the container, in the entry point script.</p>
<p>But I don't like so much installing gpg along with Django and it's dependencies. I am now thinking of running another container on the same network, which sole responsibility will be serving the config to the first container.</p>
<p><strong>Is it secure ? Is there a better way ?</strong></p>

<docker><docker-compose><dockerfile><configuration>
is a secrets-provider-container a good idea?
Quentin Gaultier
# is a secrets-provider-container a good idea?

(Asked by: username_0 on 2020-12-27)

I am looking for a way to provide secrets to a container running on Google Cloud Run responding to the following criteria:

* secure
* centralized & pulled based
* free
* simple
* working with a team, with various trust scopes
* host agnostic: changing 1 config will be the same on aws, gcp, azure

When starting a new project with containers, I always come to the point where I need to manage secrets, and I often find it difficult. **My current solution** is to store my secrets encrypted on a public git repository, and decrypt them inside the container, in the entry point script.

But I don't like so much installing gpg along with Django and it's dependencies. I am now thinking of running another container on the same network, which sole responsibility will be serving the config to the first container.

**Is it secure ? Is there a better way ?**

**Tags:** docker, docker-compose, dockerfile, configuration


---

## 1 answers

### Answer by username_1 on 2020-12-31. Score: 1

There is probably a better way if you are working with Google Cloud Run. I have not tried this but I see that they have "Secret Manager" that you can use. They also mention a project Berglas that can be used to store secrets in GCS cloud storage.

In my personal experience, it find it best to leverage widely adopted solutions and avoid creating a unique solution for security. Getting it right is non trivial and it is less code you have to support.

This FAQ has doc links to the solutions I mentioned. <https://github.com/ahmetb/cloud-run-faq#how-to-configure-secrets-for-cloud-run-applications>


---

