Securing a 15-Package Crypto Monorepo: Production Docker Secrets Best Practices

说明与用途

文章说明了如何使用两文件 compose 模式和秘密挂载，在 15 包 WAIaaS 单体仓库中安全管理 Docker 秘密，防止在环境变量和 docker inspect 中泄露。

问题

Docker deployments often expose sensitive values via environment variables in compose files, risking secret leakage through docker inspect, CI/CD logs, or daemon socket access.

结果

Secrets are no longer exposed in environment variables or docker inspect, reducing risk of accidental leakage and improving overall security posture of the crypto wallet infrastructure.

工作流

• Create a secrets directory and write the master password to secrets/master_password.txt
• Set file permissions to 600 to restrict host access
• Run docker compose with base and secrets overlay files: docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d
• For first-time setup, run the container with WAIAAS_AUTO_PROVISION=true to generate a random master password and retrieve it from /data/recovery.key
• Use the CLI to set a hardened master password and delete the recovery key file
• Ensure the container runs as non-root UID 1001 and that data volumes are writable by that UID

证据

The naive approach of passing sensitive values through environment variables directly in your compose file is everywhere, and it's a real risk.

来源

When you deploy with the overlay, Docker mounts the secret files into the container at specific paths (like /run/secrets/master_password). The entrypoint script reads from those paths rather than from environment variables.

来源

The WAIaaS Docker image runs as a non-root user (UID 1001).

来源