Hacker News Reader

Comment by Gorgor | Hacker News Reader

So how do you handle what she addressed under secrets? How do you share passwords between containers? For quick and dirty stuff, I use environment variables that are set in my docker-compose file, but I have no experience running docker in production.

View on HN

Kubernetes has first-class support for secrets: key-value lists that are stored on the API server, and can be mounted into a container as a directory of files (key -> filename, value -> content). See http://kubernetes.io/docs/user-guide/secrets/#security-prope...

Best solution is a dedicated secret management tool. K8S has secret capabilities built in, or something like Hashicorp Vault.

Alternatively, I've used something as simple as DynamoDB to distribute config information and secrets to services.

How do you securely consume those secrets though - from everything I have seen with vault or consul you end up with the secret as a environmental variable that is then visible in ps listing.

Kubernetes for instance bind mounts secrets by default on read only in memory filesystems (and on Red Hat systems, with unique SELInux labels) that disappear on reboot. You can of course use secrets in env vars if you want, since sometimes it is easier. The hard part is a lot of handy public docker images use env by default, so you end up being tempted into env for convenience.

And does that Docker instance need a token to read the password out of key/value store somewhere? How then do you securely distribute the token? It seems like that would just be pushing the problem elsewhere.

Also I am assuming that something is preventing that tmpfs filesystem from swapping to disk?

The initial secret can be passed using the cubbyhole technique -- a time- and use- limited token that retrieves the actual token from a 'cubbyhole'.

The long-term secret can be accessed through the native clients for many PLs, which are basically just wrappers around the HTTP(S) API. The long-term secret is never exposed.

I reallllly like Vault it's been a breeze.

environment variables are problematic, as they can be read by other processes potentially. Vault or another secrets management tool is a better option. A secrets management solution integrated into Docker is planned, as it is difficult to get right without tooling support.

Is there a way to prevent other processes from reading environment variables?

on linux kernel >= 3.2 you can mount /proc with the option hidepid=2. However this isn't a very elegant solution in my opinion.

Does Vault actually address the problem of credentials being visible in the process list? I thought vault only solved the secure distribution part.

Reply on news.ycombinator.com