Geek Answers Handbook

Hide / obfuscate the docker environment

I am using the mysql image as an example, but the question is general.

The password used to start mysqld in docker does not appear in ps docker, however it appears in docker:

sudo docker run --name mysql-5.7.7 -e MYSQL_ROOT_PASSWORD=12345 -d mysql:5.7.7 CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES b98afde2fab7 mysql:5.7.7 "/entrypoint.sh mysq 6 seconds ago Up 5 seconds 3306/tcp mysql-5.7.7 sudo docker inspect b98afde2fab75ca433c46ba504759c4826fa7ffcbe09c44307c0538007499e2a "Env": [ "MYSQL_ROOT_PASSWORD=12345", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "MYSQL_MAJOR=5.7", "MYSQL_VERSION=5.7.7-rc" ]

Is there a way to hide / obfuscate the environment parameters that are passed when containers start. Alternatively, can you pass sensitive parameters via a link to a file?

+5
mysql docker
source share
2 answers

You say: “Alternatively, you can pass confidential parameters via a link to a file?”, --env-file=[] Read in a file of environment variables from the document http://docs.docker.com/reference/commandline/run/ --env-file=[] Read in a file of environment variables .

+2
source share

Strange, I'm just writing an article about this.

I would advise against using environment variables to keep secrets, mainly for the reasons Diogo Monica describes here ; they are visible in many places (associated containers, docker inspection, child processes) and are likely to get into debugging information and problem reports. I don’t think that using an environment variable file will help alleviate any of these problems, although it will stop the values ​​that will be stored in your shell’s history.

Instead, you can pass your secret in, for example:

 $ docker run -v $(pwd)/my-secret-file:/secret-file ....

If you really want to use an environment variable, you can pass it as a script to be sent, which will at least hide it from checked and related containers (e.g. CMD source /secret-file && /run-my-app )

The main disadvantage of using the volume is that you run the risk of accidentally checking the file in version control.

A better, but more complicated solution is to get it from a store of key values ​​such as etcd (with crypt ), keywhiz, or vault .

+7
source share

More articles:


All Articles