Hardcoding database passwords, API tokens, and private keys into Git repositories or plain environment variables in docker-compose.yaml is a critical security vulnerability.

This guide explains how to implement Docker Native File Secrets and configure a secure GitOps workflow that guarantees zero secrets leak into version control.

services:
  database:
    image: mariadb:11.4
    restart: unless-stopped
    environment:
      - MARIADB_ROOT_PASSWORD_FILE=/run/secrets/db_root_password
      - MARIADB_PASSWORD_FILE=/run/secrets/db_password
      - MARIADB_USER=appuser
      - MARIADB_DATABASE=production_db
    secrets:
      - db_root_password
      - db_password
    volumes:
      - db-data:/var/lib/mysql

secrets:
  db_root_password:
    file: ./secrets/db_root_password.txt
  db_password:
    file: ./secrets/db_password.txt

1. The Danger of Plain Environment Variables

Passing secrets via environment: - DB_PASS=secret123 is fundamentally insecure because:

• Values are exposed in plaintext to all processes via docker inspect <container>.
• Environment variables leak into crash logs, telemetry agents, and child processes.

2. Implementing Docker Compose File Secrets

Using Docker secrets mounts secrets in-memory as files inside /run/secrets/ in the container:

services:
  database:
    image: mariadb:11.4
    restart: unless-stopped
    environment:
      - MARIADB_ROOT_PASSWORD_FILE=/run/secrets/db_root_password
      - MARIADB_PASSWORD_FILE=/run/secrets/db_password
      - MARIADB_USER=appuser
      - MARIADB_DATABASE=production_db
    secrets:
      - db_root_password
      - db_password
    volumes:
      - db-data:/var/lib/mysql

secrets:
  db_root_password:
    file: ./secrets/db_root_password.txt
  db_password:
    file: ./secrets/db_password.txt

3. GitOps Hygiene: The .gitignore Rule

Always structure your GitOps repository with a strictly enforced gitignore policy:

# .gitignore in root of stacks repository
**/secrets/*.txt
**/0.secrets/
*.env
*.key
*.pem

Related Runbooks in This Series

• The Complete GitOps Deployment Lifecycle: Forgejo, Webhooks, Komodo & Docker Compose
• Enterprise Secrets Management: Docker Native File Secrets and GitOps Security Hygiene
• Modern Git Workflows, SSH Signing & Ed25519 Best Practices
• Declarative Server Administration: Why We Avoid Web GUIs in Favor of GitOps, Tmux & Pure CLI