Secrets Management

# WRONG — the secret is now permanently baked into this image layer
FROM node:18-alpine

ENV DB_PASSWORD=superSecretPassword123
# This ENV instruction creates a layer containing the password in plain text.
# docker history myapp:latest will show it.
# docker inspect myapp:latest will show it.
# Anyone with docker pull access has the password. Forever.
# Removing this line in a later commit does NOT remove it from the layer.

RUN npm install
COPY . .
CMD ["node", "server.js"]

# CORRECT Dockerfile — no secrets anywhere
FROM node:18-alpine

WORKDIR /app
COPY package*.json ./
RUN npm install --omit=dev
COPY . .

RUN addgroup -S appgroup && \
    adduser -S appuser -G appgroup && \
    chown -R appuser:appgroup /app
USER appuser

EXPOSE 3000
CMD ["node", "server.js"]
# The application reads process.env.DB_PASSWORD at runtime.
# The Dockerfile has zero knowledge of what that value is.

# Option A — pass secrets individually at runtime
docker run -d \
  --name payment-api \
  -e DB_PASSWORD=superSecretPassword123 \
  -e STRIPE_API_KEY=sk_live_abc123xyz \
  -p 3000:3000 \
  payment-api:v1.2.0
# Secrets are injected into the container's environment at start.
# They never touch the image. They live only in the running container.

# Option B — load from a local .env file (NEVER commit this file)
docker run -d \
  --name payment-api \
  --env-file .env.production \
  -p 3000:3000 \
  payment-api:v1.2.0
# .env.production lives only on the deployment server.
# It must be in .gitignore — no exceptions.

# Verify the .gitignore entry exists:
echo ".env*" >> .gitignore

# .env file — lives on the server, NEVER in the git repository
DB_PASSWORD=superSecretPassword123
STRIPE_API_KEY=sk_live_abc123xyz
REDIS_PASSWORD=redisSecret456
JWT_SECRET=jwt-signing-key-goes-here

# Confirm this pattern is in .gitignore before anything else:
# .env
# .env.*

# docker-compose.yml — safe to commit, contains no secret values
version: "3.8"

services:
  api:
    image: payment-api:v1.2.0
    environment:
      - DB_PASSWORD=${DB_PASSWORD}
      # Compose reads the value from .env at runtime.
      # The compose file only holds the variable name — never the value.
      - STRIPE_API_KEY=${STRIPE_API_KEY}
      - JWT_SECRET=${JWT_SECRET}
    ports:
      - "3000:3000"
    depends_on:
      - db

  db:
    image: postgres:15-alpine
    environment:
      - POSTGRES_PASSWORD=${DB_PASSWORD}
      # Same secret, injected into both services at runtime.
      # One .env file — two consumers — zero hardcoded values.

  redis:
    image: redis:7-alpine
    command: redis-server --requirepass ${REDIS_PASSWORD}

# Create a secret — value stored encrypted on the Swarm manager
echo "superSecretPassword123" | docker secret create db_password -
# The `-` reads from stdin — no secret ever touches a file on disk.
# The secret is now encrypted and stored in the Swarm's Raft log.

echo "sk_live_abc123xyz" | docker secret create stripe_api_key -
echo "jwt-signing-key-goes-here" | docker secret create jwt_secret -

# List secrets — names are visible, values are not
docker secret ls
ID                          NAME             CREATED
xk2p9abcd1ef2gh3ij4kl5mn6   db_password      2 minutes ago
op7qr8st9uv0wx1yz2ab3cd4e   stripe_api_key   2 minutes ago

# Deploy a service with access to specific secrets
docker service create \
  --name payment-api \
  --secret db_password \
  --secret stripe_api_key \
  --secret jwt_secret \
  -p 3000:3000 \
  payment-api:v1.2.0
# Each secret is mounted as a file at /run/secrets/<secret_name>
# inside the container — readable only by the process user.

// Application code — reads secrets from files, not environment variables
const fs = require('fs');

function readSecret(name) {
  const secretPath = `/run/secrets/${name}`;
  try {
    return fs.readFileSync(secretPath, 'utf8').trim();
    // .trim() removes the trailing newline Docker appends
  } catch (err) {
    throw new Error(`Secret '${name}' not found at ${secretPath}`);
  }
}

const dbPassword   = readSecret('db_password');
const stripeApiKey = readSecret('stripe_api_key');
const jwtSecret    = readSecret('jwt_secret');

// Values are now in memory only.
// Never in environment variables.
// Never printed by docker inspect.
// Never in the image.

# syntax=docker/dockerfile:1
FROM node:18-alpine

WORKDIR /app
COPY package*.json ./

# The secret is mounted at /run/secrets/npm_token for this RUN step only.
# After the step completes, the mount is gone — it exists in no image layer.
RUN --mount=type=secret,id=npm_token \
    NPM_TOKEN=$(cat /run/secrets/npm_token) \
    npm config set //registry.npmjs.org/:_authToken=${NPM_TOKEN} && \
    npm install --omit=dev && \
    npm config delete //registry.npmjs.org/:_authToken
# The token is used, then immediately deleted from .npmrc.
# BuildKit discards the secret mount after the RUN — it leaves no trace.

COPY . .
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser
EXPOSE 3000
CMD ["node", "server.js"]

# Build with BuildKit secret — token read from env, never a build arg
DOCKER_BUILDKIT=1 docker build \
  --secret id=npm_token,env=NPM_TOKEN \
  -t payment-api:v1.2.0 .
# id=npm_token   → matches --mount=type=secret,id= in the Dockerfile
# env=NPM_TOKEN  → reads value from the local environment variable NPM_TOKEN
# The token never appears in --build-arg.
# The token never appears in docker history.

# Verify it left no trace:
docker history --no-trunc payment-api:v1.2.0 | grep -i token
(no output — the token left no trace in any layer)