Securing a 15-Package Crypto Monorepo: Production Docker Secrets Best Practices

Описание и применение

В статье описывается, как безопасно управлять секретами в Docker для 15‑пакетного монорепозитория WAIaaS, используя два файла compose и монтирование секретов, чтобы исключить их видимость в переменных окружения и docker inspect.

Задача

Docker deployments often expose sensitive values via environment variables in compose files, risking secret leakage through docker inspect, CI/CD logs, or daemon socket access.

Результат

Secrets are no longer exposed in environment variables or docker inspect, reducing risk of accidental leakage and improving overall security posture of the crypto wallet infrastructure.

Рабочий процесс

• Create a secrets directory and write the master password to secrets/master_password.txt
• Set file permissions to 600 to restrict host access
• Run docker compose with base and secrets overlay files: docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d
• For first-time setup, run the container with WAIAAS_AUTO_PROVISION=true to generate a random master password and retrieve it from /data/recovery.key
• Use the CLI to set a hardened master password and delete the recovery key file
• Ensure the container runs as non-root UID 1001 and that data volumes are writable by that UID

Доказательства

The naive approach of passing sensitive values through environment variables directly in your compose file is everywhere, and it's a real risk.

Источник

When you deploy with the overlay, Docker mounts the secret files into the container at specific paths (like /run/secrets/master_password). The entrypoint script reads from those paths rather than from environment variables.

Источник

The WAIaaS Docker image runs as a non-root user (UID 1001).

Источник