<p>Found this -->  <a href="https://devops.stackexchange.com/questions/3902/passing-secrets-to-a-docker-container?rq=1">Passing secrets to a Docker container</a></p>

<p>Environment variables appear the preferred method - will need to run a prebuild script to fetch the secrets and then follow this</p>

<p><a href="https://docs.docker.com/compose/environment-variables/" rel="nofollow noreferrer">https://docs.docker.com/compose/environment-variables/</a></p>

<p>@Mods feel free to close as a duplicate</p>

CC BY-SA 4.0
2018-09-01T00:19:58.410Z
In addition, try to run containers in a virtual network ([see here](https://docs.microsoft.com/en-us/windows-server/networking/sdn/manage/connect-container-endpoints-to-a-tenant-virtual-network)), then configure your key vault to restrict access to the vnet where the containers run. This way even if someone steals access credentials for key vault, the person would need to compromise more in order to extract secrets.
fernacolo
CC BY-SA 4.0
2018-08-30T12:12:49.860Z
2018-08-30T12:12:49.860Z
Chris McKelt
<p>I am using docker-compose to create 5 containers that run my application.
Two containers need credentials retrieve from Azure Key Vault (web.config passwords to access 3rd party service).  </p>

<p>As I am committing this to a public repo I do not want to store any azure credentials in plain text in the docker-compose.yaml file when starting up each container.</p>

<p>Is there a better way to do this?  </p>

<p>I am thinking to use <a href="https://github.com/mariotoffia/FluentDocker" rel="noreferrer">https://github.com/mariotoffia/FluentDocker</a> to grab the secrets and dynamically create each container - but wonder if there is a better way?</p>

<p>Can I use Azure Key Vault with Docker? </p>

<p>Is it easier to use Docker secrets?</p>

<p>Or something else?</p>

CC BY-SA 4.0
2020-02-20T08:22:20.153Z
Do not follow the OP's answer to this question. Using environment variables to pass secrets is very bad practice! Instead use Docker Secrets. Docker Secrets securely passes and stores secrets to your Docker Container.
D.O.
<docker><docker-compose><azure><key-management>
docker compose & azure key vault - passing secrets to a container on startup
Chris McKelt
# docker compose & azure key vault - passing secrets to a container on startup

(Asked by: username_0 on 2018-08-28)

I am using docker-compose to create 5 containers that run my application.
Two containers need credentials retrieve from Azure Key Vault (web.config passwords to access 3rd party service).

As I am committing this to a public repo I do not want to store any azure credentials in plain text in the docker-compose.yaml file when starting up each container.

Is there a better way to do this?

I am thinking to use <https://github.com/mariotoffia/FluentDocker> to grab the secrets and dynamically create each container - but wonder if there is a better way?

Can I use Azure Key Vault with Docker?

Is it easier to use Docker secrets?

Or something else?

**Tags:** docker, docker-compose, azure, key-management

> **Comments:**
> **username_1**: Do not follow the OP's answer to this question. Using environment variables to pass secrets is very bad practice! Instead use Docker Secrets. Docker Secrets securely passes and stores secrets to your Docker Container.  

---

## 1 answers

### Answer by username_0 on 2018-08-30. Score: 3 | Accepted answer

Found this --> [Passing secrets to a Docker container](https://devops.stackexchange.com/questions/3902/passing-secrets-to-a-docker-container?rq=1)

Environment variables appear the preferred method - will need to run a prebuild script to fetch the secrets and then follow this

<https://docs.docker.com/compose/environment-variables/>

@Mods feel free to close as a duplicate

> **Comments:**
> **username_2**: In addition, try to run containers in a virtual network ([see here](https://docs.microsoft.com/en-us/windows-server/networking/sdn/manage/connect-container-endpoints-to-a-tenant-virtual-network)), then configure your key vault to restrict access to the vnet where the containers run. This way even if someone steals access credentials for key vault, the person would need to compromise more in order to extract secrets.  

---

