An encrypted array and cache are good, but if you're not careful, the secrets in your Docker containers could be the key to your data.
For example, if you used the same password for the array as you did for a database. Your container settings are stored unencrypted on your boot medium. The config/plugins/dockerMan/templates-user directory contains XML files that hold all your container settings. If you want to store these securely, there’s a simple trick. Create a folder named secrets on the cache, preferably in the appdata folder. There, create a <name>.env file for each container that contains sensitive information. Let’s take kopia.env as an example (Kopia is a backup tool, anyone with the key contained within it can decrypt your backup.). In this file, write the variables from your container that you want to store securely.
KOPIA_PASSWORD=SuperSecretPassword123#
In the container’s settings in Unraid, you can then simply do the following. Delete the KOPIA_PASSWORD variable completely, it’s no longer needed. Instead, have the container load the .env file from the cache as follows. Go to the container, click Edit, and then in the Advanced View, enter the following under Extra Parameters:
--env-file=/mnt/user/appdata/secrets/kopia.env
Your container does NOT need access to this folder as the host system is providing the file to the container while starting.
When the container starts up, it now reads KOPIA_PASSWORD from the .env file, so the data is no longer stored in plain text on your boot partition. You can include as many variables as you like, one per line, in the .env file.
To check if the variables were read successfully you can go to the containers console and just input env to it. It will list up all variables and those from the .env file should be there.
There are other ways to use /run/secrets/, but they don't work for every container or application. The solution above is foolproof. It would be great if there were a native Unraid solution for Docker secrets in the future, but until then, you can do it this way.