Dockerfile Security Best Practices

Re:Dockerfile Security Best Practices by vorticalbox on Wednesday October 14, 2020 @02:02PM (#24779559)

Quick question of you're not meant to use env for secrets then how are you meant to get secrets into your application?

What's the best way to handle this?

[ Parent | on HN ]

Re:Dockerfile Security Best Practices by tynorf on Wednesday October 14, 2020 @02:07PM (#24779609)

Probably either via a third party service (such as AWS secrets manager), or mounted as files scoped to the user your process is running as (which is not root, right? :) ).

[ Parent | on HN ]

Re:Dockerfile Security Best Practices by raxor53 on Wednesday October 14, 2020 @02:09PM (#24779633)

Typically your host will have a service specifically for secrets. For example: https://docs.github.com/en/free-pro-team@latest/rest/referen...

[ Parent | on HN ]

Re:Dockerfile Security Best Practices by CGamesPlay on Wednesday October 14, 2020 @08:35PM (#24783455)

Two kinds of secrets: build-time (I need an API key to access a download needed to set up the container) and run-time (I need an API key to talk to the database). The post argues against using ENV for build-time secrets, but it's still recommended for run-time secrets. Sibling comments address alternatives for getting build-time secrets in.

[ Parent | on HN ]

Re:Dockerfile Security Best Practices by keikun17 on Wednesday October 14, 2020 @02:06PM (#24779599)

using buildkit https://pythonspeed.com/articles/docker-build-secrets/

[ Parent | on HN ]