Docker Container Secrets Management

Secrets management is closley related to configuration management. You want to make sure you:

• Never hardcode secrets (such as passwords) inside a container image
• Never commit secrets to your git repo in plain text

So where do you put secrets?

The key options are

A secrets management service
Use a tool to encrypt and store your secrets

For secrets management for container hosting, we use the Amber Secrets tool to manage container secrets.

The nice thing about amber is that you only have 1 secret to manage - called the `AMBER_KEY`, and only that single secret gets entered into your CI/CD pipeline tool (e.g. Github Actions, Jenkins , Azure Devops etc).

If you've used these Devops platforms a lot, you'll know how cumbersome it can be enter multiple secrets into the various UIs,
secrets management becomes 'clickops' and not automated. By using a programatic tool, you can easily version your secrets, and even rotate them with an audit trail of your git history- remember the secrets are encrypted using your `AMBER_KEY`

Where can I learn more about this?

Recommended reading is The Twelve-Factor App- III. Config page since that
goes over much of the topics covered here.

When you host a Docker container with content hosting, you get Amber setup for you already to manage secrets.

What are the alternatives?

There are an overwhelming amount of options for secrets management for docker containers (and remember, that's just a brand name,
see what is container hosting?.

Some options include:

• Hashicorp Vault- which works very well paired with their other product Consul & consul template. But be prepared for high resource requirements (see their reference architecture) - it's not for small toys
• Ansible vault - Very similar to Amber. You can use Ansible to encrypt text and entire files. You don't have to use Ansible to use Ansible vault

The key takeaway is to manage secrets and control them carefully- ideally rotate them often. The tools change quite rapidly but the important concepts tend not to as much.