Managing Swarm Secrets and Configs

1. Creating Secrets

Option	Values	Description
--driver	`file` or `pass`	Driver to use for secret storage (default: `file`)
--template-driver	`golang`	Template driver for secret values (default: `golang`)

Example: Creating a secret from a file

docker secret create my_secret /path/to/secret.txt

Example: Creating a secret from stdin

echo "my-secret-value" | docker secret create my_secret -

Note: Secrets are stored encrypted at rest in the Raft log and are only decrypted when accessed by a service.

2. Listing Secrets

Command	Description	Options
docker secret ls	List all secrets	`--format`, `--filter`

Example: List all secrets

docker secret ls

Example: List secrets with custom format

docker secret ls --format "{{.ID}}\t{{.Name}}"

Example: Filter secrets by name

docker secret ls --filter name=prod-db-password

3. Inspecting Secrets

Command	Description	Example
docker secret inspect	Display detailed information about a secret	`docker secret inspect my-secret`
docker secret ls	List all secrets	`docker secret ls`

Example: Inspecting a Secret

docker secret inspect my-secret

{
  "ID": "abc123def456",
  "Version": {
    "Index": 1
  },
  "CreatedAt": "2026-01-01T10:00:00Z",
  "UpdatedAt": "2026-01-01T10:00:00Z",
  "Spec": {
    "Name": "my-secret",
    "Labels": {}
  }
}

Note: The inspect command returns the secret's metadata and configuration, but not its actual value.

4. Using Secrets in Services

Option	Description	Example
--secret	Mount a secret into a service	`docker service create --secret mysecret nginx`
--config	Mount a config into a service	`docker service create --config myconfig nginx`

Example: Using a secret in a service

docker service create \
  --secret db_password \
  --env DB_PASSWORD_FILE=/run/secrets/db_password \
  myapp

Example: Using a config in a service

docker service create \
  --config config.json \
  --env CONFIG_FILE=/etc/config.json \
  myapp

Note: Secrets are mounted as files in /run/secrets/ inside the container.

Warning: Ensure that secrets are properly managed and not exposed in logs or command-line arguments.

5. Mounting Secrets at Custom Paths

Option	Values	Description
--secret	`source=secret-name,target=/custom/path`	Mounts a secret at a custom path inside the container

Example: Mounting a secret at a custom path

docker service create \
  --secret source=api-key,target=/etc/app/api.key \
  myapp:latest

Note: The custom path must be absolute and cannot contain .. or . components.

6. Setting Secret Permissions

Permission	Description	CLI Command	Example
read	Allows reading the secret value	`docker secret inspect <secret>`	`docker secret inspect my-secret`
write	Allows creating or updating the secret	`docker secret create <secret> <file>`	`docker secret create my-secret /path/to/secret.txt`
remove	Allows deleting the secret	`docker secret rm <secret>`	`docker secret rm my-secret`

Example: Assigning Secret Permissions to a Service

docker service create \
  --secret source=my-secret,target=/run/secrets/my-secret \
  --secret uid=1000,gid=1000,mode=400 \
  my-app

Note: Permissions are managed at the service level using --secret flags with uid, gid, and mode options.

7. Removing Secrets

Option	Values	Notes
docker secret rm	`secret-name`	Remove a secret by name

Example: Remove a secret

docker secret rm my-secret

Note: The secret must not be in use by any service to be removed.

8. Creating Configs

Configs in Docker Swarm are used to store configuration data that can be mounted into services. They are similar to secrets but are not encrypted.

Option	Description	Example
--name	Name of the config	`my-config`
--data	Configuration data as a string	`config-data`
--file	Path to a file containing config data	`/path/to/config-file`

Example: Creating a Config from a File

docker config create my-config /path/to/config-file

Example: Creating a Config from Literal Data

docker config create my-config "config-data"

9. Listing Configs

Property	Description	Example
docker config ls	List all configs	`docker config ls`
docker config ls --filter	Filter configs by name or ID	`docker config ls --filter name=prod-config`
docker config ls --format	Format output using Go template	`docker config ls --format "{{.Name}}\t{{.ID}}"`

Example: Listing all configs

docker config ls

NAME                DATA                CREATED             UPDATED
prod-config         123 bytes          2 hours ago         2 hours ago
dev-config          456 bytes          3 hours ago         3 hours ago

Example: Filtering configs by name

docker config ls --filter name=prod-config

NAME                DATA                CREATED             UPDATED
prod-config         123 bytes          2 hours ago         2 hours ago

10. Inspecting Configs

Property	Description	Example
docker config inspect	Displays detailed information about a config	`docker config inspect my-config`
--format	Formats the output using a Go template	`docker config inspect --format "{{.Spec.Data}}" my-config`

Example: Inspecting a Config

docker config inspect my-config

Note: The inspect command shows the config's metadata, creation time, and data.

11. Using Configs in Services

Option	Values	Notes
--config	`source=NAME[,target=PATH],uid=UID,GID=GID,mode=MODE]`	Attach a config to a service

Example: Attach Config to Service

docker service create --config source=my-config,target=/etc/config.json,mode=0644 my-app

Note: Configs are mounted as read-only filesystems inside containers.

Warning: Ensure the config file is properly secured and not containing sensitive data in plain text.

Key Points

Configs are used to store non-sensitive configuration data.
They can be mounted into services at runtime.
Configs are not encrypted by default; consider encryption for sensitive data.

12. Removing Configs

Command	Description	Notes
docker config rm <config-name>	Remove a config from the swarm	Must be run on a manager node

Example: Remove a config

docker config rm my-config

Note: The config must not be in use by any service to be removed.