How can I securely store environment variables like API keys in my Docker containers?

Hey there 👋,

If you’re using Docker in a Swarm or Kubernetes setup, Docker Secrets is a great way to securely manage sensitive information. Secrets are encrypted and are only available to the containers that need them. However, this feature isn’t available for standalone Docker instances (like on a single Droplet), but it’s something to keep in mind if you’re using orchestration tools.

For Docker Swarm:

docker secret create my_secret_file /path/to/secret/file

You can then access the secret inside your container via a mounted file.

Another simpler approach you can take for single-Droplet setups is using .env files. Store your environment variables in a .env file and then reference them inside your docker-compose.yml or docker run commands.

Example .env file:

API_KEY=your-api-key
DB_PASSWORD=your-db-password

You can load this file when running the container:

docker run --env-file .env your_image

Or in your docker-compose.yml:

version: "3"
services:
  app:
    image: your_image
    env_file:
      - .env

If you don’t want to use .env files, you can also mount a volume with a file containing the sensitive data. This way, you don’t expose secrets as environment variables but instead as files in your container.

Example:

docker run -v /path/to/secret_file:/run/secrets/secret your_image

Hope that helps!

- Bobby