Docker Secret Examples and Usage with Compose Files

- [`docker secret create`](/reference/cli/docker/secret/create.md) - [`docker secret inspect`](/reference/cli/docker/secret/inspect.md) - [`docker secret ls`](/reference/cli/docker/secret/ls.md) - [`docker secret rm`](/reference/cli/docker/secret/rm.md) - [`--secret`](/reference/cli/docker/service/create.md#secret) flag for `docker service create` - [`--secret-add` and `--secret-rm`](/reference/cli/docker/service/update.md#secret-add) flags for `docker service update` ## Examples This section includes three graduated examples which illustrate how to use Docker secrets. The images used in these examples have been updated to make it easier to use Docker secrets. To find out how to modify your own images in a similar way, see [Build support for Docker Secrets into your images](#build-support-for-docker-secrets-into-your-images). > [!NOTE] > > These examples use a single-Engine swarm and unscaled services for > simplicity. The examples use Linux containers, but Windows containers also > support secrets. See [Windows support](#windows-support). ### Defining and using secrets in compose files Both the `docker-compose` and `docker stack` commands support defining secrets in a compose file. See [the Compose file reference](/reference/compose-file/legacy-versions.md) for details. ### Simple example: Get started with secrets This simple example shows how secrets work in just a few commands. For a real-world example, continue to [Intermediate example: Use secrets with a Nginx service](#intermediate-example-use-secrets-with-a-nginx-service). 1. Add a secret to Docker. The `docker secret create` command reads standard input because the last argument, which represents the file to read the secret from, is set to `-`. ```console $ printf "This is a secret" | docker secret create my_secret_data - ``` 2. Create a `redis` service and grant it access to the secret. By default, the container can access the secret at `/run/secrets/<secret_name>`, but you can customize the file name on the container using the `target` option. ```console $ docker service create --name redis --secret my_secret_data redis:alpine ``` 3. Verify that the task is running without issues using `docker service ps`. If everything is working, the output looks similar to this: ```console $ docker service ps redis ID NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS bkna6bpn8r1a redis.1 redis:alpine ip-172-31-46-109 Running Running 8 seconds ago ``` If there were an error, and the task were failing and repeatedly restarting, you would see something like this: ```console $ docker service ps redis NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS redis.1.siftice35gla redis:alpine moby Running Running 4 seconds ago \_ redis.1.whum5b7gu13e redis:alpine moby Shutdown Failed 20 seconds ago "task: non-zero exit (1)" \_ redis.1.2s6yorvd9zow redis:alpine moby Shutdown Failed 56 seconds ago "task: non-zero exit (1)" \_ redis.1.ulfzrcyaf6pg redis:alpine moby Shutdown Failed about a minute ago "task: non-zero exit (1)" \_ redis.1.wrny5v4xyps6 redis:alpine moby Shutdown Failed 2 minutes ago "task: non-zero exit (1)" ``` 4. Get the ID of the `redis` service task container using `docker ps` , so that you can use `docker container exec` to connect to the container and read the contents of the secret data file, which defaults to being readable by all and has the same name as the name of the secret. The first command below illustrates how to find the container ID, and the second and third commands use shell completion to do this automatically. ```console $ docker ps --filter name=redis -q 5cb1c2348a59

This section provides practical examples of using Docker secrets, including how to define and use them in Compose files for both `docker-compose` and `docker stack` commands. It demonstrates a simple example of creating a secret, granting a service access to it, and verifying its accessibility within a container. The example includes steps to add a secret, create a Redis service with access to the secret, and verify the service is running correctly, as well as troubleshooting steps. It also covers how to access the secret within the container.