3 ms·
Quick question of you're not meant to use env for secrets then how are you meant to get secrets into your application? What's the best way to handle this?
by vorticalbox 6y ago
Quick question of you're not meant to use env for secrets then how are you meant to get secrets into your application?
What's the best way to handle this?
- keikun17 6y agousing buildkit https://pythonspeed.com/articles/docker-build-secrets/ https://pythonspeed.com/articles/docker-build-secrets/
- tynorf 6y agoProbably either via a third party service (such as AWS secrets manager), or mounted as files scoped to the user your process is running as (which is not root, right? :) ).
- raxor53 6y agoTypically your host will have a service specifically for secrets. For example: https://docs.github.com/en/free-pro-team@latest/rest/reference/actions#secrets https://docs.github.com/en/free-pro-team@latest/rest/referen...
- CGamesPlay 6y agoTwo kinds of secrets: build-time (I need an API key to access a download needed to set up the container) and run-time (I need an API key to talk to the database). The post argues against using ENV for build-time secrets, but it's still recommended for run-time secrets. Sibling comments address alternatives for getting build-time secrets in.