Securing a 15-Package Crypto Monorepo: Production Docker Secrets Best Practices

Description and use

The article explains how to securely manage secrets in Docker for a 15‑package WAIaaS monorepo using a two‑file compose pattern and secret mounting to prevent exposure in environment variables and docker inspect.

Problem

Docker deployments often expose sensitive values via environment variables in compose files, risking secret leakage through docker inspect, CI/CD logs, or daemon socket access.

Outcome

Secrets are no longer exposed in environment variables or docker inspect, reducing risk of accidental leakage and improving overall security posture of the crypto wallet infrastructure.

Workflow

• Create a secrets directory and write the master password to secrets/master_password.txt
• Set file permissions to 600 to restrict host access
• Run docker compose with base and secrets overlay files: docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d
• For first-time setup, run the container with WAIAAS_AUTO_PROVISION=true to generate a random master password and retrieve it from /data/recovery.key
• Use the CLI to set a hardened master password and delete the recovery key file
• Ensure the container runs as non-root UID 1001 and that data volumes are writable by that UID

Evidence

The naive approach of passing sensitive values through environment variables directly in your compose file is everywhere, and it's a real risk.

Source

When you deploy with the overlay, Docker mounts the secret files into the container at specific paths (like /run/secrets/master_password). The entrypoint script reads from those paths rather than from environment variables.

Source

The WAIaaS Docker image runs as a non-root user (UID 1001).

Source