Answers: <blockquote>
    <p>I want to avoid situtations where someone with access to the machine can just copy out some user data, or even look at it.</p>
  </blockquote>
  
  <p>You cannot stop someone with local access to the machine from reading data on the machine.  Full stop.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-09-30T12:24:46.027Z
Answers: 2019-09-30T12:24:46.027Z
Answers: Jean-Paul Calderone
Answers: <p>You could save the data in a database. That database can be also a container (deploy them both with docker-compose maybe). The database is password protected and it can persist its encrypted data on the disk between runs.</p>
  
  <p>Also you can use <a href="https://www.vaultproject.io/" rel="nofollow noreferrer">Hashicorp Vault</a> (see <a href="https://docs.docker.com/samples/library/vault/" rel="nofollow noreferrer">https://docs.docker.com/samples/library/vault/</a>).</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-04-03T08:11:47.390Z
Answers: Thanks for the answer!
  
  Databases unfortunately will not work, since the main concern of the data are a few files of couple hundred megabytes that can't be put to a database. 
  
  Will vaults help us with that? Correct me if I am wrong but is a vault basically, in its essence, a password protected volume/folder?
Answers: Martin1
Answers: CC BY-SA 4.0
Answers: 2019-04-03T04:25:32.090Z
Answers: 2019-08-31T05:50:48.177Z
Answers: 2019-08-31T05:50:48.177Z
Answers: Mihai
Body: <p>I'm working on a system where a dockerized application must run on client side machines (Ubuntu PC), with some sensitive data that must persist between runs that we want to limit access to. In prototyping I just stored the data in the host file system and used a bind mount to map that folder into the application container. </p>
  
  <p>I want to avoid situtations where someone with access to the machine can just copy out some user data, or even look at it. </p>
  
  <p>What would be a good solution in my case?</p>
  
  <p>What I have read from google this sounds to be a bit of a different use case as to where user data/docker volumes are securely hidden away between the (fire)walls of server rooms and cloud instances and I haven't therefore been able to find a good solution on how to limit access to said user data so that no one (no proccess, nothing) except the running container has access to that data, even with physical access to the machine. </p>
  
  <p>I am also very new to DevOps and deploying systems so I would appreciate  any insight on how to solve that matter!</p>
  
Comments: CC BY-SA 4.0
Comments: 2019-08-31T05:41:18.190Z
Comments: If you are worried about the data being compromised on the host, then it seems to me the only way to really protect the data is to encrypt it at rest. Whether you do this in a database or in flat files is irrelevant, the data needs to be encrypted. You might have limited room to move on the machine itself if it belongs to a client, but you should definitely try to lock it down as much as possible.
Comments: Bruce Becker
Tags: <docker>
Title: How to secure persistent user data with docker on client location?
UserDisplayName: Martin1
ThreadText: # How to secure persistent user data with docker on client location?
  
  (Asked by: username_0 on 2019-04-02)
  
  I'm working on a system where a dockerized application must run on client side machines (Ubuntu PC), with some sensitive data that must persist between runs that we want to limit access to. In prototyping I just stored the data in the host file system and used a bind mount to map that folder into the application container.
  
  I want to avoid situtations where someone with access to the machine can just copy out some user data, or even look at it.
  
  What would be a good solution in my case?
  
  What I have read from google this sounds to be a bit of a different use case as to where user data/docker volumes are securely hidden away between the (fire)walls of server rooms and cloud instances and I haven't therefore been able to find a good solution on how to limit access to said user data so that no one (no proccess, nothing) except the running container has access to that data, even with physical access to the machine.
  
  I am also very new to DevOps and deploying systems so I would appreciate any insight on how to solve that matter!
  
  **Tags:** docker
  
  > **Comments:**
  > **username_1**: If you are worried about the data being compromised on the host, then it seems to me the only way to really protect the data is to encrypt it at rest. Whether you do this in a database or in flat files is irrelevant, the data needs to be encrypted. You might have limited room to move on the machine itself if it belongs to a client, but you should definitely try to lock it down as much as possible.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2019-09-30. Score: 1
  
  > I want to avoid situtations where someone with access to the machine can just copy out some user data, or even look at it.
  
  You cannot stop someone with local access to the machine from reading data on the machine. Full stop.
  
  
  ---
  
  ### Answer by username_3 on 2019-04-03. Score: 0
  
  You could save the data in a database. That database can be also a container (deploy them both with docker-compose maybe). The database is password protected and it can persist its encrypted data on the disk between runs.
  
  Also you can use [Hashicorp Vault](https://www.vaultproject.io/) (see <https://docs.docker.com/samples/library/vault/>).
  
  > **Comments:**
  > **username_0**: Thanks for the answer!  Databases unfortunately will not work, since the main concern of the data are a few files of couple hundred megabytes that can't be put to a database.   Will vaults help us with that? Correct me if I am wrong but is a vault basically, in its essence, a password protected volume/folder?  
  
  ---
  
  