You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm thinking of pretty much everything passed through an environment variable, but especially:
VAULT_APP_ID
VAULT_USER_ID
VAULT_AUTH_GITHUB_TOKEN
VAULT_AUTH_USERNAME
VAULT_AUTH_PASSWORD
VAULT_ROLE_ID
VAULT_SECRET_ID
VAULT_TOKEN - even though ~/.vault-token is already read by default, this one is still valuable since swarm secrets can only be exposed at /run/secrets (because they're in a tmpfs in-memory filesystem)
Basically each one of these would have an equivalent *_FILE version that would point to a file to be read.
The text was updated successfully, but these errors were encountered:
With new Docker Swarm Secrets, and when running
gomplate
inside a container running in a Swarm service, it'd be more secure forgomplate
to be able to read secrets from files instead of environment variables. See https://docs.docker.com/engine/swarm/secrets/#build-support-for-docker-secrets-into-your-imagesI'm thinking of pretty much everything passed through an environment variable, but especially:
VAULT_APP_ID
VAULT_USER_ID
VAULT_AUTH_GITHUB_TOKEN
VAULT_AUTH_USERNAME
VAULT_AUTH_PASSWORD
VAULT_ROLE_ID
VAULT_SECRET_ID
VAULT_TOKEN
- even though~/.vault-token
is already read by default, this one is still valuable since swarm secrets can only be exposed at/run/secrets
(because they're in atmpfs
in-memory filesystem)Basically each one of these would have an equivalent
*_FILE
version that would point to a file to be read.The text was updated successfully, but these errors were encountered: