Introducing Docker Secrets Management

Re:Introducing Docker Secrets Management by cpuguy83 on Thursday February 09, 2017 @02:20PM (#13609954)

You can update a service to not use a secret once it's not needed. Of course this will restart the task(s) I think. Definitely worth thinking about. Maybe a single-read secret or something.

If a service is compromised, you should always assume the secret is compromised.

[ Parent | on HN ]

Re:Introducing Docker Secrets Management by mikegerwitz on Thursday February 09, 2017 @02:23PM (#13609987)

> Maybe a single-read secret or something.

I like this idea. As a benefit, you wouldn't have to rely on developers of individual services to make sure the secret is cleared. This would also have the benefit of causing an error if something else happened to read the secret before the intended service, indicating a possible compromise (or maybe just a misconfiguration).

(I use a similar concept with `xclip -l' to allow reading passwords from the clipboard a single time before it quits.)

[ Parent | on HN ]