Painless Docker - 2nd Edition

Compromising Secrets

Docker containers and images frequently handle sensitive data, often referred to as "secrets" (e.g., passwords, API keys, SSH certificates). If not managed correctly, this data is vulnerable to theft in two states:

• In Transit: When data is being transmitted unprotected over the network between services.
• At Rest: When secrets are hardcoded directly into the Docker image filesystem.

While these risks exist in traditional architecture, the complexity of microservices increases the number of secrets required (service-to-service authentication), thereby expanding the attack surface.