DEV Community

Cover image for A Better Way to Handle Docker Secrets — No Cloud, No .env, No Leaks
Md Umair
Md Umair

Posted on

A Better Way to Handle Docker Secrets — No Cloud, No .env, No Leaks

#devops #docker #security #opensource

🚨 The "Invisible" Security Hole in Your Docker Setup

We've all heard it: "Don't commit .env files to Git."

So you .gitignore them, pat yourself on the back, and move on. But here's the uncomfortable truth — your secrets are still exposed. They're sitting in plain text on your server's disk, and more embarrassingly, they're baked right into your container's metadata.

Don't believe me? Try this on any Docker host you have access to:

docker inspect <container_id> | grep -A10 "Env"
Enter fullscreen mode Exit fullscreen mode

There they are. DB passwords, Stripe keys, API tokens — readable by anyone with basic Docker access. No hacking required.

That’s why I rebuilt Docker Secret Operator (DSO).

🚀 DSO v3.2: Local-First, Cloud-Optional

The original DSO was designed for production environments — AWS, Vault, that sort of thing. But v3.2 is different. It's built for every developer, including you on your laptop right now.

The headline feature: "Zero-Cloud" Local Mode.
No AWS account.
No root access.
No background daemon.

Just a clean, secure way to handle secrets locally.

Feature .env Files Docker Secrets (Swarm) DSO v3.2
Storage Plaintext on disk Encrypted (Swarm only) AES-256-GCM Vault
Git Safety High risk Safe Native (~/.dso)
Inspect Leak ❌ Exposed ✅ Secure ✅ Secure (dsofile://)
Cloud Sync ❌ Manual ❌ None ✅ AWS / Vault / Azure
Complexity Low High (needs Swarm) Low (one command)

🔄 The "Before & After"
Most setups today:

services:
  api:
    env_file: .env  # ❌ Plaintext secrets sitting on your disk
Enter fullscreen mode Exit fullscreen mode

With DSO:

services:
  db:
    image: postgres:15
    environment:
      POSTGRES_PASSWORD_FILE: dsofile://app/db_pass
Enter fullscreen mode Exit fullscreen mode

What happens under the hood:

  1. DSO parses your compose file (AST-level, not string replace)
  2. Detects dsofile://
  3. Mounts a tmpfs (RAM disk) inside the container
  4. Streams the secret directly into memory

Result:

  • ❌ No disk storage
  • ❌ Not visible in docker inspect
  • ✅ Exists only in RAM
  • 👻 Disappears when container stops

☁️ Production Mode: Fully Real Now

If you're running production workloads, Cloud Mode is now fully implemented (not stubs anymore):

  1. **HashiCorp Vault
  2. AWS Secrets Manager
  3. Azure Key Vault
  4. Huawei CSMS**

Setup:

sudo docker dso system setup
Enter fullscreen mode Exit fullscreen mode

It:

  • installs plugins
  • verifies SHA256 checksums
  • configures systemd
  • starts the agent

🩺 The Doctor Command (No More Guessing)
When something feels off:

docker dso system doctor
Enter fullscreen mode Exit fullscreen mode

Example output:

DSO System Diagnostics — v3.2.0
════════════════════════════════════════════════════════════
Component         Status     Detail
────────────────────────────────────────────────────────────
Binary            OK         /usr/local/bin/dso (v3.2.0)
Effective UID     1000
Detected Mode     LOCAL      Reason: auto-detected (~/.dso/vault.enc)
Config            NOT FOUND  /etc/dso/dso.yaml
Vault             OK         /home/user/.dso/vault.enc
Systemd Service   NOT FOUND  dso-agent.service
Plugin: vault     MISSING
════════════════════════════════════════════════════════════
Enter fullscreen mode Exit fullscreen mode

You instantly know:

  • mode (Local vs Cloud)
  • vault health
  • plugin status
  • system issues 👉 Works great as a CI/CD pre-check too.

📦 Zero-Dependency Setup

No Go. No build. No friction.

# Install
curl -fsSL https://raw.githubusercontent.com/docker-secret-operator/dso/main/scripts/install.sh | bash

# Initialize vault
docker dso init

# Store secret
docker dso secret set myapp/db_pass

# Run stack
docker dso up -d
Enter fullscreen mode Exit fullscreen mode

Done. No .env file. No plaintext secrets.

🔗 Links
GitHub: https://github.com/docker-secret-operator/dso
Docs: https://dso.skycloudops.in/docs/

💬 Final Thought

Most secret leaks don’t happen in production.

They happen in:

  • laptops
  • staging environments
  • “temporary setups”

If you're still using .env files… try this once.

🚀 Feedback

  • What are you using today?
  • Google Secret Manager?
  • 1Password?
  • Something custom?

Drop a comment — it directly shapes what I build next.

Top comments (0)