docker-secret

Create a new secret from stdin

$ [command] | docker secret create [secret_name] -

$ docker secret create [secret_name] [path/to/file]

$ docker secret ls

$ docker secret inspect --pretty [secret_name1 secret_name2 ...]

$ docker secret rm [secret_name1 secret_name2 ...]

docker secret create|inspect|ls|rm [OPTIONS] [ARGS]

--driver string (create)
    Secret driver (default: default)

--label, -l list (create)
    Key-value labels for secrets

--format, -f string (inspect, ls)
    Go template for custom output

--pretty (inspect)
    Human-readable format (default: true)

--filter, -f filter (ls)
    Filter secrets (e.g., dangling=true)

--quiet, -q (ls)
    Display only secret IDs

The docker secret command manages secrets in Docker Swarm mode, providing a secure mechanism to handle sensitive data like passwords, certificates, and keys. Secrets are encrypted at rest on manager nodes and during transit, mounted read-only as files in containers at /run/secrets/<name> with 0444 permissions.

Key operations include creating secrets from files or stdin, listing with filters, inspecting details, and removing them. Secrets are Swarm-scoped, replicated to necessary nodes, and automatically rotated or cleaned up. They enhance security by avoiding environment variables or plaintext configs, integrating seamlessly with Docker services via --secret flags.

Requires initialized Swarm cluster; not for standalone Docker. Supports drivers for external secret stores like Vault. Ideal for production microservices needing credential isolation.

Requires Swarm mode; secrets immutable after creation; accessible only by rootless users with permissions; external drivers need plugins.

In services: docker service create --secret src=mysecret,target=/secrets/pass; auto-mounted read-only.

Encrypted at rest/transit; tmpfs mount avoids disk persistence; use docker secret inspect for metadata.

Introduced in Docker 1.13.0 (2017) with SwarmKit for secure secret management, evolved in later releases with label support and drivers.

docker-service(1), docker-node(1), docker-config(1)