Answers: <blockquote>
    <p>Once the secret reaches a manager node, it gets saved to the internal
    Raft store, which uses NACL’s Salsa20Poly1305 with a 256-bit key to
    ensure no data is ever written to disk unencrypted. <strong>Writing to the
    internal store gives secrets the same high availability guarantees
    that the the rest of the swarm management data gets.</strong></p>
  </blockquote>
  
  <p><a href="https://blog.docker.com/2017/02/docker-secrets-management/" rel="nofollow noreferrer">https://blog.docker.com/2017/02/docker-secrets-management/</a></p>
  
Answers: CC BY-SA 3.0
Answers: 2018-01-22T07:12:04.520Z
Answers: 2018-01-22T07:12:04.520Z
Answers: Ta Mu
Answers: <p>Extending Peter Muryshkin’s answer with an significant restriction. Distributing secrets has to be adapted to a <a href="https://docs.docker.com/engine/swarm/secrets/#use-secrets-in-compose" rel="nofollow noreferrer">file-based approach</a>.</p>
  
  <blockquote>
    <p>Note: Docker secrets do not set environment variables directly. This
    was a conscious decision, because environment variables can
    unintentionally be leaked between containers (for instance, if you use
    --link).</p>
  </blockquote>
  
  <p>Some images already support this such as <a href="https://hub.docker.com/r/_/wordpress/" rel="nofollow noreferrer">Wordpress</a> and <a href="https://hub.docker.com/_/mysql/" rel="nofollow noreferrer">MySQL</a> while others have to be updated to use this approach.</p>
  
Answers: CC BY-SA 3.0
Answers: 2018-01-22T22:08:47.647Z
Answers: 2018-01-22T22:08:47.647Z
Answers: Moritz
Body: <p>Currently I use env and sql files so that docker compose can load secrets from there and build sql database docker instances with specific user/password. The question is, how can this be ported to docker swarm? Docker secrets seem to only provide secret files over encrypted channels, but not set environment variables or be able to configure docker builds.</p>
  
Tags: <docker-compose><docker-swarm>
Title: How can secrets be distributed in a docker swarm?
UserDisplayName: Moritz
ThreadText: # How can secrets be distributed in a docker swarm?
  
  (Asked by: username_0 on 2018-01-21)
  
  Currently I use env and sql files so that docker compose can load secrets from there and build sql database docker instances with specific user/password. The question is, how can this be ported to docker swarm? Docker secrets seem to only provide secret files over encrypted channels, but not set environment variables or be able to configure docker builds.
  
  **Tags:** docker-compose, docker-swarm
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2018-01-22. Score: 2 | Accepted answer
  
  > Once the secret reaches a manager node, it gets saved to the internal
  > Raft store, which uses NACL’s Salsa20Poly1305 with a 256-bit key to
  > ensure no data is ever written to disk unencrypted. **Writing to the
  > internal store gives secrets the same high availability guarantees
  > that the the rest of the swarm management data gets.**
  
  <https://blog.docker.com/2017/02/docker-secrets-management/>
  
  
  ---
  
  ### Answer by username_0 on 2018-01-22. Score: 1
  
  Extending Peter Muryshkin’s answer with an significant restriction. Distributing secrets has to be adapted to a [file-based approach](https://docs.docker.com/engine/swarm/secrets/#use-secrets-in-compose).
  
  > Note: Docker secrets do not set environment variables directly. This
  > was a conscious decision, because environment variables can
  > unintentionally be leaked between containers (for instance, if you use
  > --link).
  
  Some images already support this such as [Wordpress](https://hub.docker.com/r/_/wordpress/) and [MySQL](https://hub.docker.com/_/mysql/) while others have to be updated to use this approach.
  
  
  ---
  
  