SecurityIntermediate

Docker Secrets Cheatsheet

Securely manage sensitive data like passwords and tokens in Docker Swarm and Compose.

What it is

Docker Secrets provides a secure way to pass sensitive data (passwords, API keys, certificates) to containers without baking them into images or exposing them as plain-text environment variables.

Quick start

echo "my_password" | docker secret create db_password -

Create a secret from stdin.

docker secret ls

List all secrets.

docker service create --secret db_password myapp

Create a service with a mounted secret.

Common commands

Task	Command	Description
Create from stdin	`echo "value" \| docker secret create <name> -`	Create a secret from standard input.
Create from file	`docker secret create <name> ./secret.txt`	Create a secret from a file.
List secrets	`docker secret ls`	Show all secrets (values are never shown).
Inspect secret	`docker secret inspect <name>`	Show metadata (not the value).
Remove secret	`docker secret rm <name>`	Delete a secret (not if in use).
Use in service	`docker service create --secret <name> <image>`	Mount secret at /run/secrets/<name>.

Real-world examples

Secrets in docker-compose

services:
  db:
    image: postgres:16
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    secrets:
      - db_password

secrets:
  db_password:
    file: ./secrets/db_password.txt

Best practices

Never pass secrets as -e env vars — they appear in docker inspect and process lists.
Use the _FILE env var pattern for databases that support it.
Rotate secrets by creating a new secret with a new name and updating services.

Related cheatsheets

Last reviewed: 2026-06-15