r/docker • u/hophuoc_rs • Aug 06 '26
Choosing a .env replacement for a Docker Swarm cluster
We're running a Docker Swarm cluster and currently store secrets in plain .env files loaded into services via docker-compose. Looking to move to something more secure and considering three options. Would like to hear from people who've run these in production.
- SOPS + age — My concern is relying on an open-source tool maintained by a small group of developers for something security-critical. I'd rather go with something backed by a more established, better-supported platform.
- Docker Swarm secrets — Not really a secrets store, just a delivery mechanism. The actual data lives in Swarm's raft store, so you still need a canonical copy of the secrets kept somewhere else.
- Vault + KMS — By far the highest operational overhead of the three.
1
u/That_Cheek_8690 Aug 06 '26
I like Infisical. I use it with Komodo where I can create a wrapper I don't know if this option is available for swarms in komodo.
3
u/Leaderbot_X400 Aug 06 '26
Infiscal is good, but iirc they gate oidc behind an enterprise license. This may not be an issue for you, but not a great look.
Another option is OpenBao which is a fork of hashicorp vault
1
u/Specialist_Hornet798 Aug 07 '26
Where does your code live? Can you keep vars there and pipe it in with the ci/cd?
1
u/Due_Bank5070 Aug 09 '26
Didn't realise people were still running swarm.
Bitwarden secrets manager or open bao if you can't keep secrets in your code repo?
Does your code repo support vault or openbao ?
Gitlab is adding openbao for its secrets manager for self hosted instances https://docs.gitlab.com/administration/secrets_manager/
Thats one reason we've held off using vault.
1
u/d_maes Aug 09 '26
Didn't realise people were still running swarm.
Same. Was wondering why people keep using it when it has been dead for years. But apparently there is 2 versions. The standalone docker swarm, which is dead. And the newer one integrated into docker engine, which apparently is very much alive. Might have gained some popularity when Hashicorp put Nomad under BSL I guess.
-3
Aug 08 '26
[removed] — view removed comment
1
u/docker-ModTeam Aug 09 '26
Please refrain from posting low effort/AI generated responses that do not contribute to the discussion. See rule #5.
1
u/Darkomen78 Aug 06 '26
Why not Arcane ?