Answers: <p>Use environment variables, like this example:</p>
  <p><strong>.env</strong></p>
  <pre><code># remember to set correct permissions to protect this file
  SERVER='dbserver.example.com'
  POSTGRES_USER=admin
  POSTGRES_PASSWORD='p@$$w0rd'
  </code></pre>
  <p><strong>docker-compose.yml</strong></p>
  <pre><code>---
  version: '3'
  services:
    postgresql:
      image: postgres:12.16-bookworm
      container_name: postgresql
      restart: unless-stopped
      volumes:
        - /var/lib/postgresql/data:/var/lib/postgresql/data
      ports:
        - 5432:5432
      environment:
        SERVER: ${SERVER}
        POSTGRES_USER: ${POSTGRES_USER}
        POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2024-06-04T17:37:26.297Z
Answers: Thank you, my friend, but I have some questions. Why use .env and not secrets? And what would be the correct permissions to protect the .env file?
Answers: user981
Answers: CC BY-SA 4.0
Answers: 2024-06-04T19:01:46.203Z
Answers: @user981 set `.env` to `600`
Answers: mikequentel
Answers: CC BY-SA 4.0
Answers: 2024-06-04T19:07:52.467Z
Answers: and, as far as using secrets vs `.env`, secrets appears to be designed to work with [Swarm](https://docs.docker.com/reference/cli/docker/secret)
Answers: mikequentel
Answers: CC BY-SA 4.0
Answers: 2024-06-04T01:47:51.540Z
Answers: 2024-06-04T01:47:51.540Z
Answers: mikequentel
Body: <p>I hope you are well. I have some questions about Docker secrets:</p>
  <ul>
  <li>How can I work with secrets securely using Docker Compose, given that their content is exposed in /run/secrets and can be easily accessed with cat both inside and outside the containers?</li>
  </ul>
  <p>Additionally, to run as a user with minimal permissions inside the container, I need to keep the permissions of the secret files open on the host machine, because if I set them as root-only, the non-root user inside the container will not be able to read their content and the application will not be able to work with the information.</p>
  <p>This is how I have been working with secrets in my Docker Compose.</p>
  <pre class="lang-yaml prettyprint-override"><code>services:
    app:
      [...]
      depends_on:
        - db
      secrets:
        - postgres_db
        - postgres_server
        - postgres_user
        - postgres_password
      [...]
      networks:
        - app_net
        - db_net
    
    db:
      image: postgres:16.3-alpine3.20
      restart: always
      environment:
        POSTGRES_DB_FILE: /run/secrets/postgres_db
        POSTGRES_USER_FILE: /run/secrets/postgres_user
        POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      secrets:
        - postgres_db
        - postgres_user
        - postgres_password
      [...]
  
  secrets:
    postgres_db:
      file: ./secrets/postgres_db.txt
    postgres_server:
      file: ./secrets/postgres_server.txt
    postgres_user:
      file: ./secrets/postgres_user.txt
    postgres_password:
      file: ./secrets/postgres_password.txt
  </code></pre>
  
Tags: <docker><docker-compose>
Title: How to work with Docker Compose secrets securely
UserDisplayName: user981
ThreadText: # How to work with Docker Compose secrets securely
  
  (Asked by: username_0 on 2024-06-02)
  
  I hope you are well. I have some questions about Docker secrets:
  
  * How can I work with secrets securely using Docker Compose, given that their content is exposed in /run/secrets and can be easily accessed with cat both inside and outside the containers?
  
  Additionally, to run as a user with minimal permissions inside the container, I need to keep the permissions of the secret files open on the host machine, because if I set them as root-only, the non-root user inside the container will not be able to read their content and the application will not be able to work with the information.
  
  This is how I have been working with secrets in my Docker Compose.
  
  ```yaml
  services:
    app:
      [...]
      depends_on:
        - db
      secrets:
        - postgres_db
        - postgres_server
        - postgres_user
        - postgres_password
      [...]
      networks:
        - app_net
        - db_net
    
    db:
      image: postgres:16.3-alpine3.20
      restart: always
      environment:
        POSTGRES_DB_FILE: /run/secrets/postgres_db
        POSTGRES_USER_FILE: /run/secrets/postgres_user
        POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      secrets:
        - postgres_db
        - postgres_user
        - postgres_password
      [...]
  
  secrets:
    postgres_db:
      file: ./secrets/postgres_db.txt
    postgres_server:
      file: ./secrets/postgres_server.txt
    postgres_user:
      file: ./secrets/postgres_user.txt
    postgres_password:
      file: ./secrets/postgres_password.txt
  
  ```
  
  **Tags:** docker, docker-compose
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2024-06-04. Score: 0 | Accepted answer
  
  Use environment variables, like this example:
  
  **.env**
  
  ```
  # remember to set correct permissions to protect this file
  SERVER='dbserver.example.com'
  POSTGRES_USER=admin
  POSTGRES_PASSWORD='p@$$w0rd'
  
  ```
  
  **docker-compose.yml**
  
  ```
  ---
  version: '3'
  services:
    postgresql:
      image: postgres:12.16-bookworm
      container_name: postgresql
      restart: unless-stopped
      volumes:
        - /var/lib/postgresql/data:/var/lib/postgresql/data
      ports:
        - 5432:5432
      environment:
        SERVER: ${SERVER}
        POSTGRES_USER: ${POSTGRES_USER}
        POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
  
  ```
  
  > **Comments:**
  > **username_0**: Thank you, my friend, but I have some questions. Why use .env and not secrets? And what would be the correct permissions to protect the .env file?  
  > **username_1**: @username_0 set `.env` to `600`  
  > **username_1**: and, as far as using secrets vs `.env`, secrets appears to be designed to work with [Swarm](https://docs.docker.com/reference/cli/docker/secret)  
  
  ---
  
  