Answers: <p>There is probably a better way if you are working with Google Cloud Run.  I have not tried this but I see that they have &quot;Secret Manager&quot; that you can use.  They also mention a project Berglas that can be used to store secrets in GCS cloud storage.</p>
  <p>In my personal experience, it find it best to leverage widely adopted solutions and avoid creating a unique solution for security.  Getting it right is non trivial and it is less code you have to support.</p>
  <p>This FAQ has doc links to the solutions I mentioned.  <a href="https://github.com/ahmetb/cloud-run-faq#how-to-configure-secrets-for-cloud-run-applications" rel="nofollow noreferrer">https://github.com/ahmetb/cloud-run-faq#how-to-configure-secrets-for-cloud-run-applications</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2020-12-31T01:25:06.837Z
Answers: 2020-12-31T01:25:06.837Z
Answers: sig9
Body: <p>I am looking for a way to provide secrets to a container running on Google Cloud Run responding to the following criteria:</p>
  <ul>
  <li>secure</li>
  <li>centralized &amp; pulled based</li>
  <li>free</li>
  <li>simple</li>
  <li>working with a team, with various trust scopes</li>
  <li>host agnostic: changing 1 config will be the same on aws, gcp, azure</li>
  </ul>
  <p>When starting a new project with containers, I always come to the point where I need to manage secrets, and I often find it difficult.  <strong>My current solution</strong> is to store my secrets encrypted on a public git repository, and decrypt them inside the container, in the entry point script.</p>
  <p>But I don't like so much installing gpg along with Django and it's dependencies. I am now thinking of running another container on the same network, which sole responsibility will be serving the config to the first container.</p>
  <p><strong>Is it secure ? Is there a better way ?</strong></p>
  
Tags: <docker><docker-compose><dockerfile><configuration>
Title: is a secrets-provider-container a good idea?
UserDisplayName: Quentin Gaultier
ThreadText: # is a secrets-provider-container a good idea?
  
  (Asked by: username_0 on 2020-12-27)
  
  I am looking for a way to provide secrets to a container running on Google Cloud Run responding to the following criteria:
  
  * secure
  * centralized & pulled based
  * free
  * simple
  * working with a team, with various trust scopes
  * host agnostic: changing 1 config will be the same on aws, gcp, azure
  
  When starting a new project with containers, I always come to the point where I need to manage secrets, and I often find it difficult. **My current solution** is to store my secrets encrypted on a public git repository, and decrypt them inside the container, in the entry point script.
  
  But I don't like so much installing gpg along with Django and it's dependencies. I am now thinking of running another container on the same network, which sole responsibility will be serving the config to the first container.
  
  **Is it secure ? Is there a better way ?**
  
  **Tags:** docker, docker-compose, dockerfile, configuration
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-12-31. Score: 1
  
  There is probably a better way if you are working with Google Cloud Run. I have not tried this but I see that they have "Secret Manager" that you can use. They also mention a project Berglas that can be used to store secrets in GCS cloud storage.
  
  In my personal experience, it find it best to leverage widely adopted solutions and avoid creating a unique solution for security. Getting it right is non trivial and it is less code you have to support.
  
  This FAQ has doc links to the solutions I mentioned. <https://github.com/ahmetb/cloud-run-faq#how-to-configure-secrets-for-cloud-run-applications>
  
  
  ---
  
  