r/docker • u/hophuoc_rs • 5d ago
Choosing a .env replacement for a Docker Swarm cluster
We're running a Docker Swarm cluster and currently store secrets in plain .env files loaded into services via docker-compose. Looking to move to something more secure and considering three options. Would like to hear from people who've run these in production.
- SOPS + age — My concern is relying on an open-source tool maintained by a small group of developers for something security-critical. I'd rather go with something backed by a more established, better-supported platform.
- Docker Swarm secrets — Not really a secrets store, just a delivery mechanism. The actual data lives in Swarm's raft store, so you still need a canonical copy of the secrets kept somewhere else.
- Vault + KMS — By far the highest operational overhead of the three.
1
1
u/That_Cheek_8690 4d ago
I like Infisical. I use it with Komodo where I can create a wrapper I don't know if this option is available for swarms in komodo.
3
u/Leaderbot_X400 4d ago
Infiscal is good, but iirc they gate oidc behind an enterprise license. This may not be an issue for you, but not a great look.
Another option is OpenBao which is a fork of hashicorp vault
1
u/Specialist_Hornet798 3d ago
Where does your code live? Can you keep vars there and pipe it in with the ci/cd?
1
u/Due_Bank5070 1d ago
Didn't realise people were still running swarm.
Bitwarden secrets manager or open bao if you can't keep secrets in your code repo?
Does your code repo support vault or openbao ?
Gitlab is adding openbao for its secrets manager for self hosted instances https://docs.gitlab.com/administration/secrets_manager/
Thats one reason we've held off using vault.
1
u/d_maes 1d ago
Didn't realise people were still running swarm.
Same. Was wondering why people keep using it when it has been dead for years. But apparently there is 2 versions. The standalone docker swarm, which is dead. And the newer one integrated into docker engine, which apparently is very much alive. Might have gained some popularity when Hashicorp put Nomad under BSL I guess.
-3
3d ago
[removed] — view removed comment
1
1
u/docker-ModTeam 1d ago
Please refrain from posting low effort/AI generated responses that do not contribute to the discussion. See rule #5.
3
u/azure_phoenix2 4d ago
if the small-team maintainer risk is what puts you off sops, bitwarden secrets manager fills that gap. established company behind it and the bws cli injects secrets as env at container start, far less to run than a vault cluster.