Sign inSign up

zachbg/secrets-init

By zachbg

•Updated 6 months ago

Inject secrets from files into env vars at runtime - no plaintext passwords

Image
1

1.7K

zachbg/secrets-init repository overview

⁠Secrets Init

Drop-in entrypoint wrapper that injects secrets from files into environment variables at runtime. No more plaintext passwords in docker-compose.yml.

⁠Why?

Docker Compose .env files contain passwords in plain text. Docker Swarm has secrets but Docker Compose doesn't (well). This image bridges the gap: store secrets in files, inject them as env vars at container start. Works with Docker Compose, Swarm, Kubernetes, and any orchestrator.

⁠Quick Start

⁠Docker Compose with secret files
services:
  app:
    image: myapp
    entrypoint: ["secrets-init", "--"]
    command: ["node", "server.js"]
    volumes:
      - ./secrets:/run/secrets:ro
    environment:
      DB_PASSWORD_FILE: /run/secrets/db_password

# Create secret files:
# echo "supersecret" > ./secrets/db_password
# echo "s3key12345" > ./secrets/aws_key
⁠As init container (copy binary into your image)
FROM zachbg/secrets-init:latest AS secrets
FROM node:22-alpine
COPY --from=secrets /usr/local/bin/secrets-init /usr/local/bin/
ENTRYPOINT ["secrets-init", "--"]
CMD ["node", "server.js"]

⁠How It Works

Three secret sources, processed in order:

  1. _FILE suffix variables: DB_PASSWORD_FILE=/run/secrets/db_pass → reads file → sets DB_PASSWORD
  2. Secrets directory: Files in /run/secrets/ → filename becomes variable name, contents become value
  3. Encrypted env file: Reads from a .env file specified by SECRETS_ENV_FILE

⁠Environment Variables

VariableDefaultDescription
SECRETS_DIR/run/secretsDirectory to scan for secret files
SECRETS_PREFIX_FILESuffix for file-reference variables
SECRETS_ENV_FILEPath to .env file to load
SECRETS_LOGfalseLog loaded variable names (not values)

⁠Examples

⁠PostgreSQL with secrets
services:
  postgres:
    image: postgres:17
    entrypoint: ["secrets-init", "--"]
    command: ["docker-entrypoint.sh", "postgres"]
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/pg_password
    volumes:
      - ./secrets:/run/secrets:ro

# echo "MySecurePassword123" > ./secrets/pg_password
⁠Multiple secrets from directory
mkdir -p secrets
echo "dbpass123" > secrets/DATABASE_PASSWORD
echo "AKIAIOSFODNN7EXAMPLE" > secrets/AWS_ACCESS_KEY_ID
echo "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" > secrets/AWS_SECRET_ACCESS_KEY

services:
  app:
    image: myapp
    entrypoint: ["secrets-init", "--"]
    command: ["python", "app.py"]
    volumes:
      - ./secrets:/run/secrets:ro

All files in /run/secrets/ automatically become environment variables.

⁠Docker Swarm secrets
services:
  app:
    image: myapp
    entrypoint: ["secrets-init", "--"]
    command: ["node", "index.js"]
    secrets:
      - db_password
      - api_key

secrets:
  db_password:
    external: true
  api_key:
    external: true

Swarm places secrets in /run/secrets/ — secrets-init picks them up automatically.

Tag summary

Content type

Image

Digest

sha256:c7491a2cb…

Size

4.2 MB

Last updated

6 months ago

docker pull zachbg/secrets-init