DEV Community

SOVANNARO
SOVANNARO

Posted on • Edited on

🔐 Using Secrets with Local Docker Compose: Secure Your Config Like a Pro!

#docker

Docker Compose is a handy tool for running multi-container applications. But when it comes to storing sensitive information—like API keys, database passwords, or secret tokens—hardcoding them in your docker-compose.yml is a big no-no. 🧨

Luckily, Docker Compose supports a secrets feature to keep things safe—even in local development!

Let’s walk through how to use secrets with local Docker Compose like a pro. 💪

🧠 What Are Docker Secrets?

Docker secrets allow you to store confidential data outside your code. These secrets can be files or values that your services read securely at runtime.

In Swarm mode, secrets are managed by the orchestrator. But in local development (non-Swarm), we can still use secrets with Docker Compose, just in a slightly different way.

🏗️ Folder Structure Example 

. ├── docker-compose.yml ├── secrets/ │ ├── db_password.txt │ └── api_key.txt
Enter fullscreen mode Exit fullscreen mode

You store your secrets as plain text files in a folder (e.g., secrets/).

🛠️ Step-by-Step: How to Use Secrets in Local Docker Compose

1. 📝 Create Secret Files

Each secret should be in its own file:

# secrets/db_password.txt super-secret-password # secrets/api_key.txt my-very-secret-api-key
Enter fullscreen mode Exit fullscreen mode

🔐 Keep the secrets/ folder out of version control by adding it to .gitignore!

# .gitignore secrets/
Enter fullscreen mode Exit fullscreen mode

2. 🧾 Update docker-compose.yml

Here’s how to use secrets in Compose (v3+):

version: '3.8' services: app: image: your-app-image build: . secrets: - db_password - api_key environment: DB_PASSWORD_FILE: /run/secrets/db_password API_KEY_FILE: /run/secrets/api_key db: image: postgres environment: POSTGRES_PASSWORD_FILE: /run/secrets/db_password secrets: - db_password secrets: db_password: file: ./secrets/db_password.txt api_key: file: ./secrets/api_key.txt
Enter fullscreen mode Exit fullscreen mode

✅ What Happens Behind the Scenes?

Docker Compose mounts the secret files inside the container at:

/run/secrets/<secret_name>
Enter fullscreen mode Exit fullscreen mode

Your app should read the content of the file, not expect it as an environment variable.

For example, in Node.js you could do:

const fs = require('fs'); const dbPassword = fs.readFileSync('/run/secrets/db_password', 'utf-8').trim(); console.log('DB Password:', dbPassword);
Enter fullscreen mode Exit fullscreen mode

💡 Pro Tips

  • 🧪 Use docker-compose down -v to clear secrets and volumes when stopping services.
  • 🔍 Never log secret values in your console or logs.
  • 👀 Use .env files only for non-sensitive config in dev.

🧹 Bonus: Add Some Automation

You can create a script to generate secret files easily:

#!/bin/bash mkdir -p secrets echo "super-secret-password" > secrets/db_password.txt echo "my-very-secret-api-key" > secrets/api_key.txt echo "✅ Secrets created!"
Enter fullscreen mode Exit fullscreen mode

🎉 Wrapping Up

Using secrets in local Docker Compose isn’t just for pros—it’s for anyone who wants to write secure, production-like local setups. With just a few simple steps, you can keep your secrets safe and your app happy.

Remember: Treat your local setup like production and your future self will thank you!

Top comments (0)