<commit_before>---
layout: post
title: "Docker compose with swarm secrets"
date:   2017-02-14 10:51:47 +0530
author: "@marcosnils"
tags: [docker, compose, swarm secrets]
categories: docker
img: "docker-secrets.png"
---

Start securing your swarm services using the latest compose reference that allows to specify secrets in your application stack

## Requirements

Docker 1.13.1 and compose 1.11.1

## Getting started

Make sure your daemon is in swarm mode or initialize it as follows:

```.term1
docker swarm init --advertise-addr $(hostname -i)
```

### Automatic provision

In this example we'll let compose automatically create our secrets and provision them through compose with the defined secret file

Create a new secret and store it in a file:

```.term1
echo "shh, this is a secret" > mysecret.txt
```

Use your secret file in your compose stack as follows:

```.term1
echo 'version: '\'3.1\''
services:
    test:
        image: '\'alpine\''
        command: '\'cat /run/secrets/my_secret \''
        secrets: 
            - my_secret

secrets:
    my_secret:
        file: ./mysecret.txt
' > docker-compose.yml
```

Deploy your stack service:


```.term1
docker stack deploy -c docker-compose.yml secret
```

After your stack is deployed you can check your service output:


```.term1
docker service logs -f secret_test
```

### Using existing secrets

Create a new service using the docker CLI:


```.term1
echo "some other secret" | docker secret create manual_secret - 
```

Define your secret as `external` in your compose file so it's not created while deploying the stack

```.term1
echo 'version: '\'3.1\''
services:
    test:
        image: '\'alpine\''
        command: '\'cat /run/secrets/manual_secret \''
        secrets: 
            - manual_secret

secrets:
    manual_secret:
        external: true
' > external-compose.yml
```

Deploy your stack as you did in the automatic section:

```.term1
docker stack deploy -c external-compose.yml external_secret
```

Validate your secret is there by checking the service logs
<commit_msg>Fix typo<commit_after>---
layout: post
title: "Docker compose with swarm secrets"
date:   2017-02-14 10:51:47 +0530
author: "@marcosnils"
tags: [docker, compose, swarm secrets]
categories: docker
img: "docker-secrets.png"
---

Start securing your swarm services using the latest compose reference that allows to specify secrets in your application stack

## Requirements

Docker 1.13.1 and compose 1.11.1

## Getting started

Make sure your daemon is in swarm mode or initialize it as follows:

```.term1
docker swarm init --advertise-addr $(hostname -i)
```

### Automatic provision

In this example we'll let compose automatically create our secrets and provision them through compose with the defined secret file

Create a new secret and store it in a file:

```.term1
echo "shh, this is a secret" > mysecret.txt
```

Use your secret file in your compose stack as follows:

```.term1
echo 'version: '\'3.1\''
services:
    test:
        image: '\'alpine\''
        command: '\'cat /run/secrets/my_secret \''
        secrets: 
            - my_secret

secrets:
    my_secret:
        file: ./mysecret.txt
' > docker-compose.yml
```

Deploy your stack service:


```.term1
docker stack deploy -c docker-compose.yml secret
```

After your stack is deployed you can check your service output:


```.term1
docker service logs -f secret_test
```

### Using existing secrets

Create a new secret using the docker CLI:


```.term1
echo "some other secret" | docker secret create manual_secret - 
```

Define your secret as `external` in your compose file so it's not created while deploying the stack

```.term1
echo 'version: '\'3.1\''
services:
    test:
        image: '\'alpine\''
        command: '\'cat /run/secrets/manual_secret \''
        secrets: 
            - manual_secret

secrets:
    manual_secret:
        external: true
' > external-compose.yml
```

Deploy your stack as you did in the automatic section:

```.term1
docker stack deploy -c external-compose.yml external_secret
```

Validate your secret is there by checking the service logs

{'fraction_non_alphanumeric': 0.10457198443579767, 'fraction_numerical': 0.01848249027237354, 'mean_word_length': 3.3203781512605044, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5004636', 'n_tokens_mistral': 1347, 'n_tokens_neox': 1212, 'n_words': 499}