How can secrets be distributed in a docker swarm?
Once the secret reaches a manager node, it gets saved to the internal
  Raft store, which uses NACL’s Salsa20Poly1305 with a 256-bit key to
  ensure no data is ever written to disk unencrypted. Writing to the
  internal store gives secrets the same high availability guarantees
  that the the rest of the swarm management data gets.


https://blog.docker.com/2017/02/docker-secrets-management/