3 ms·
I do not see what is so difficult about management of secretes. Just add to the command/config file that starts container an option to bind mount file with secr
by fpoling 11y ago
I do not see what is so difficult about management of secretes. Just add to the command/config file that starts container an option to bind mount file with secretes from the host like -v /path-on-the-host:/mount-point:ro with Docker and then use your favorite automation solution to transfer secrets.
And I do not see how a generic container deployment solution can help with this as distribution of secrets are way too deployment/application specific.
- brown9-2 11y agoOne issue with this strategy is that you can now only deploy that container/image on hosts with the file containing the image-specific secrets. If you want to have a large pool of generic hosts that can run any image, then you've just reduced the size of the pool for some images. If you choose instead to make every secret available to every host, then you've just spread your individual application secrets across many hosts.
- fpoling 11y agoTypically secrets imply some per-container state that has to be transferred to the host in any case. Secretes can be transferred as a part of that container-specific state setup.