Docker security risks passing secrets over environment variables I'm new to Docker and want to put my Django web application into containers.

For the last couple days I'm struggling with passing credentials safe to containers. 

Online there is always the hint that secrets should not be passed as environment variable because they can be retrieved via inspect or from the images. My hope is that it can be neglected for my setup.

The setup


I provide the credentials via .env file of docker compose. This file is not on version control.
The containers are running as non-elevanted users (a different special user).
Docker command on the host can be used as root only.
I'm the only user of the host server (Ubuntu 18.04).
I assume breaking into the host is much harder (I'm using SSH public key authentication with non-root user only) than breaking into container of the Django app. 
I don't want to use kubernetes or swarm. 


I'm newbie to Docker and not a security expert. Do I have overlooked something? Why should I care about the docker inspect or images in this setup?

Thank you in advance
ENV variables are a good way of passing secrets to a container. What you don't want to do is bake the secrets directly in the image. As you have rightly done, do not store secrets in your source control repo as well. 

Besides ENV variables, you could also consider using an external secrets repository, such as Hashicorp Vault, or possibly even AWS secrets. See also vault's github page. Your container would still need a token/credentials required to Authenticate/Authorize with the key store, but if required, these can be made to expire/rotate.

So you are on the right path. Some additional reading is worthwhile at this point:


https://medium.com/@mccode/dont-embed-configuration-or-secrets-in-docker-images-7b2e0f916fdd
https://techbeacon.com/how-keep-your-container-secrets-secure