A Docker Swarm secrets simulator to use during local development with Docker Compose
Branch: master
Clone or download
mikesir87 Merge pull request #1 from andyneff/fix
Added TERM to exclude list
Latest commit 35053c6 Dec 15, 2017
Type Name Latest commit message Commit time
Failed to load latest commit information.
Dockerfile Initial commit May 24, 2017
LICENSE Initial commit May 24, 2017
README.md Updated README to make things a bit clearer May 25, 2017
docker-compose.yml Initial commit May 24, 2017
main.go Added TERM to exclude list Sep 28, 2017


Docker Secrets Simulator

Docker Stars Docker Pulls Docker Automated Builds

Blog post here

Docker Secrets are awesome. They provide a secure way to get secret/sensitive data into your container. However, they require a Swarm to run. Since secrets are exposed simply as files in /run/secrets, we can mock it using one of two methods:

  • Mount secrets files to /run/secrets from the host (which requires you to define a file per secret)
  • Use this image!

The "Secrets Simulator" image will take all defined environment variables and create secrets files where the variable name is the filename and the variable value is the secret content. This allows you to keep everything within your docker-compose.yml!

How to Use

Here are the quick steps...

  1. Add a service using the mikesir87/secrets-simulator image to your docker-compose.yml file.
  2. Define an environment variable for each secret you want to expose in your app.
  3. Create a volume that will share the new secrets with your app and mount it to both the simulator and app services.
  4. You're done!


This is the docker-compose.yml found in the repo. So... give it a shot yourself!

version: '3.1'

    image: mikesir87/secrets-simulator
      DB_USERNAME: admin
      DB_PASSWORD: password1234!
      - secrets:/run/secrets:rw

    image: mikesir87/secrets-viewer
      - secrets:/run/secrets:ro

    driver: local

After running docker-compose up, we have output that looks like this:

$ docker-compose up
Creating network "secretsimulator_default" with the default driver
Starting secretsimulator_secrets-simulator_1 ...
Starting secretsimulator_secrets-simulator_1
Starting secretsimulator_viewer_1 ...
Starting secretsimulator_viewer_1 ... done
Attaching to secretsimulator_secrets-simulator_1, secretsimulator_viewer_1
viewer_1             | Starting to dump secrets...
viewer_1             | DB_PASSWORD : password1234!
viewer_1             | DB_USERNAME : admin
secretsimulator_secrets-simulator_1 exited with code 0
secretsimulator_viewer_1 exited with code 0

So... what happened? The contents of /run/secrets ended up looking like this...

    DB_PASSWORD      => contents of: password1234!
    DB_USERNAME      => contents of: admin


How can I pick different secrets for different apps?

You can run as many simulator services as you wish! You'll just need to create a new volume for each distinct set of secrets.

Why mount secrets as ro?

To help simulate a "real" scenario, I bind the secrets as read-only in the app. That way, I can't make any accidental changes to them.