Docker Compose Secret Injection with Docker Secret Operator

# Option A: Local Mode (development, no cloud required)
docker dso init --mode local
# Creates encrypted vault at ~/.dso/vault.enc
# Master password required (or use DSO_MASTER_PASSWORD env var)

# Option B: Cloud Mode - AWS
docker dso init --mode cloud \
  --provider aws \
  --aws-region us-east-1

# Option C: Cloud Mode - Azure
docker dso init --mode cloud \
  --provider azure \
  --azure-vault-name myKeyVault \
  --azure-managed-identity myIdentity

# Option D: Cloud Mode - Vault
docker dso init --mode cloud \
  --provider vault \
  --vault-address https://vault.example.com:8200 \
  --vault-auth-method approle

# Verify configuration
docker dso system info
        

# For Local Mode:
docker dso secret create db-password "my-secure-db-password"
docker dso secret create api-key "sk_live_1234567890"
docker dso secret create jwt-secret "your-jwt-secret-key"

# List secrets
docker dso secret list

# For Cloud Mode (AWS example):
aws secretsmanager create-secret \
  --name "app/db-password" \
  --secret-string "my-secure-db-password"

# For Cloud Mode (Azure example):
az keyvault secret set \
  --vault-name myKeyVault \
  --name db-password \
  --value "my-secure-db-password"
        

version: "3.9"

services:
  web:
    image: myapp:latest
    environment:
      # Reference secrets from DSO provider
      - DATABASE_PASSWORD=dso://db-password
      - API_KEY=dso://api-key
      - JWT_SECRET=dso://jwt-secret
      # Regular env vars work normally
      - NODE_ENV=production
      - PORT=3000
    ports:
      - "3000:3000"
    depends_on:
      - db
    networks:
      - app-network

  db:
    image: postgres:15
    environment:
      POSTGRES_PASSWORD: dso://db-password
      POSTGRES_DB: myapp
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - app-network

  cache:
    image: redis:7-alpine
    networks:
      - app-network

volumes:
  postgres_data:

networks:
  app-network:
    driver: bridge
        

# Deploy with automatic secret injection
docker dso up -d

# DSO handles:
# 1. Parse docker-compose.yaml
# 2. Find dso:// references
# 3. Authenticate to secret provider
# 4. Fetch secrets
# 5. Inject into containers
# 6. Start services

# Monitor deployment
docker dso ps

# View service status
docker dso inspect web
docker dso inspect db
docker dso inspect cache
        

# Check app can access database using injected secret
docker dso exec db psql -U postgres -d myapp -c "SELECT version();"
# Should connect successfully

# Verify connection from app container
docker dso exec web curl http://db:5432
# Should show postgres response

# Test API with injected API key
docker dso exec web curl -H "Authorization: Bearer \$API_KEY" \
  http://localhost:3000/api/status
# Should return success

# Confirm secret NOT in environment (most important)
docker dso exec web sh -c 'printenv | grep DATABASE_PASSWORD'
# Should show: DATABASE_PASSWORD=<actual-secret>

# Confirm secret NOT in logs
docker dso logs web | grep DATABASE_PASSWORD
# Should show NOTHING
        

# Start development environment
docker dso up -d

# View logs
docker dso logs -f web

# Execute commands in containers
docker dso exec web npm run migrate
docker dso exec web npm run seed

# Stop services
docker dso down

# Remove volumes (careful!)
docker dso down -v
        

# Local Mode (development)
docker dso init --mode local
docker dso up -d
# Secrets from local encrypted vault

# Switch to AWS (production)
docker dso init --mode cloud --provider aws
docker dso up -d
# Secrets from AWS Secrets Manager
# Same docker-compose.yaml, different backend!

# Switch to Azure
docker dso init --mode cloud --provider azure
docker dso up -d
# Secrets from Azure Key Vault

# Same services, same secrets, different providers
# No docker-compose.yaml changes needed