How to securely store secrets in Docker container?
The application I'm working on has more than a dozen of secrets, SSL certificates and API keys. Currently I have a file that's added into .gitignore and it contains all my secrets. How to securely store all these secrets? How enterprise apps handle this, where security is top priority?
I'm looking into AWS KMS and as far as I understand I have to encrypt all of the secrets, commit it, and then at runtime pass my AWS credentials for decrypting the secrets (user is only allowed to use KMS key for decrypting and no other permissions are added for the user).
Now, assuming the machine where containers are run is compromised - secrets are encrypted, so that should be fine, but! if docker inspect command is run, it will display all environment variables (the AWS secrets), so I exec into the container and all I have to do is to use the env variables to decrypt the secrets.. sort of defeats the purpose or maybe I am missing a step somewhere?
Note: My current solution is not secure too - file is gitignored, but it still exists on the machine where the containers are run (and later, after image is built, they are exposed as env variables).
Note 2: Git repo is private
