diogomonicapt

Don't disagree; I think what I actually tried to argue for was doing both: segregate data access to a new, minimal, service that also requires a key in an HSM to operate.

My unstated assumption was that when calling something like imagetragick you would be doing the appropriate privilege dropping using setuid and setgid. This is obviously not necessarily the case, but it's at least a lot more common than people cleaning up the ENV before creating a child process.

The problem is applications unintentionally leaking the ENV. Think a hoptoad exception that attaches the current ENV to the report that sends up to the remote server.

Or think about you exec'ing imagemagik and now the process running potentially adversarial code also has access to your parent's env.

Or think about an application crashing and doing an unintentional core dump to disk.

Way better than I could have answered ;)

We explicitly chose not to support secrets as ENV variables, since they are prone to being leaked (child processes inhering parent's env; easy to leak ps -e; bug reports usually include ENV of the application; core dumps include ENV of the application, etc etc)

- We're working on external store support. First implementation will probably be w/ Vault, but we would love for this to come from the community.

- If you have access to the managers, you have access to all the secrets (and access to administer the whole cluster), but normal swarm nodes only have access to the secrets required to run services that will be scheduled on them. Also this are erased as soon as the service is deleted or rescheduled on some other node.

Exactly. The new version of compose supports defining docker secrets inside of the compose file.

Thanks!

- Exposing secrets as in-memory files has a lot of advantages over ENV variables (harder to leak).

- We already started updating a few images (MySQL, for example), so they can use Docker secrets.

- Definitely not DDC only, but note that RBAC over secrets is a feature of the commercial product.

You can make a PCI compliant installation w/ Docker yes.