<p>Use environment variables, like this example:</p>
<p><strong>.env</strong></p>
<pre><code># remember to set correct permissions to protect this file
SERVER='dbserver.example.com'
POSTGRES_USER=admin
POSTGRES_PASSWORD='p@$$w0rd'
</code></pre>
<p><strong>docker-compose.yml</strong></p>
<pre><code>---
version: '3'
services:
  postgresql:
    image: postgres:12.16-bookworm
    container_name: postgresql
    restart: unless-stopped
    volumes:
      - /var/lib/postgresql/data:/var/lib/postgresql/data
    ports:
      - 5432:5432
    environment:
      SERVER: ${SERVER}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
</code></pre>

CC BY-SA 4.0
2024-06-04T17:37:26.297Z
Thank you, my friend, but I have some questions. Why use .env and not secrets? And what would be the correct permissions to protect the .env file?
user981
CC BY-SA 4.0
2024-06-04T19:01:46.203Z
@user981 set `.env` to `600`
mikequentel
CC BY-SA 4.0
2024-06-04T19:07:52.467Z
and, as far as using secrets vs `.env`, secrets appears to be designed to work with [Swarm](https://docs.docker.com/reference/cli/docker/secret)
mikequentel
CC BY-SA 4.0
2024-06-04T01:47:51.540Z
2024-06-04T01:47:51.540Z
mikequentel
<p>I hope you are well. I have some questions about Docker secrets:</p>
<ul>
<li>How can I work with secrets securely using Docker Compose, given that their content is exposed in /run/secrets and can be easily accessed with cat both inside and outside the containers?</li>
</ul>
<p>Additionally, to run as a user with minimal permissions inside the container, I need to keep the permissions of the secret files open on the host machine, because if I set them as root-only, the non-root user inside the container will not be able to read their content and the application will not be able to work with the information.</p>
<p>This is how I have been working with secrets in my Docker Compose.</p>
<pre class="lang-yaml prettyprint-override"><code>services:
  app:
    [...]
    depends_on:
      - db
    secrets:
      - postgres_db
      - postgres_server
      - postgres_user
      - postgres_password
    [...]
    networks:
      - app_net
      - db_net
  
  db:
    image: postgres:16.3-alpine3.20
    restart: always
    environment:
      POSTGRES_DB_FILE: /run/secrets/postgres_db
      POSTGRES_USER_FILE: /run/secrets/postgres_user
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
    secrets:
      - postgres_db
      - postgres_user
      - postgres_password
    [...]

secrets:
  postgres_db:
    file: ./secrets/postgres_db.txt
  postgres_server:
    file: ./secrets/postgres_server.txt
  postgres_user:
    file: ./secrets/postgres_user.txt
  postgres_password:
    file: ./secrets/postgres_password.txt
</code></pre>

<docker><docker-compose>
How to work with Docker Compose secrets securely
user981
# How to work with Docker Compose secrets securely

(Asked by: username_0 on 2024-06-02)

I hope you are well. I have some questions about Docker secrets:

How can I work with secrets securely using Docker Compose, given that their content is exposed in /run/secrets and can be easily accessed with cat both inside and outside the containers?

Additionally, to run as a user with minimal permissions inside the container, I need to keep the permissions of the secret files open on the host machine, because if I set them as root-only, the non-root user inside the container will not be able to read their content and the application will not be able to work with the information.
This is how I have been working with secrets in my Docker Compose.
services:
  app:
    [...]
    depends_on:
      - db
    secrets:
      - postgres_db
      - postgres_server
      - postgres_user
      - postgres_password
    [...]
    networks:
      - app_net
      - db_net
  
  db:
    image: postgres:16.3-alpine3.20
    restart: always
    environment:
      POSTGRES_DB_FILE: /run/secrets/postgres_db
      POSTGRES_USER_FILE: /run/secrets/postgres_user
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
    secrets:
      - postgres_db
      - postgres_user
      - postgres_password
    [...]

secrets:
  postgres_db:
    file: ./secrets/postgres_db.txt
  postgres_server:
    file: ./secrets/postgres_server.txt
  postgres_user:
    file: ./secrets/postgres_user.txt
  postgres_password:
    file: ./secrets/postgres_password.txt

**Tags:** docker, docker-compose


---

## 1 answers

### Answer by username_1 on 2024-06-04. Score: 0 | Accepted answer

Use environment variables, like this example:
.env
# remember to set correct permissions to protect this file
SERVER='dbserver.example.com'
POSTGRES_USER=admin
POSTGRES_PASSWORD='p@$$w0rd'

docker-compose.yml
---
version: '3'
services:
  postgresql:
    image: postgres:12.16-bookworm
    container_name: postgresql
    restart: unless-stopped
    volumes:
      - /var/lib/postgresql/data:/var/lib/postgresql/data
    ports:
      - 5432:5432
    environment:
      SERVER: ${SERVER}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}

> **Comments:**
> **username_0**: Thank you, my friend, but I have some questions. Why use .env and not secrets? And what would be the correct permissions to protect the .env file?  
> **username_1**: @username_0 set `.env` to `600`  
> **username_1**: and, as far as using secrets vs `.env`, secrets appears to be designed to work with [Swarm](https://docs.docker.com/reference/cli/docker/secret)  

---

