Have you looked into docker swarm secrets? They work only with swarm services but I think they do what you want.