← Back to Dashboard
Verified Production Fix

[docker/cli] Support for docker secrets exported as environment variables

GH-docker/cli#6678 • Mar 07, 2026

### ROOT CAUSE The current Docker implementation mounts secrets as files by default, which is secure but inconvenient for applications expecting environment variables. This leads users to employ less elegant and potentially less secure workarounds. ### CODE FIX To address the issue, we will introduce an optional mechanism to export Docker secrets as environment variables. This involves modifying the Docker CLI and compose file parsing to support the new configuration syntax. **Proposed Solution:** 1. **Update Docker CLI:** - Introduce a new option in the `docker secret` commands to specify environment variables. - Example: `docker secret create --as-env=APP_API_KEY api_key mysecretcontent` 2. **Modify Docker Compose:** - Update the compose file parser to recognize the `as_env` field under the `secrets` section. - Example:
yaml
     secrets:
       - secret: api_key
         as_env: APP_API_KEY
     


3. **Container Creation Logic:**
   - When a secret is marked with `as_env`, Docker will set the corresponding environment variable in the container.
   - Ensure that this feature is optional and does not affect the default file-based mounting.

4. **Security Considerations:**
   - Warn users about the potential security implications of exposing secrets as environment variables.
   - Make this feature opt-in to maintain security best practices.

**Example Implementation in Docker CLI:**

bash
# Create a secret with an environment variable mapping
docker secret create --as-env=DATABASE_PASSWORD db_password myDatabaseSecret

# Run a service using the secret as an environment variable
docker service create --secret db_password --as-env=DATABASE_PASSWORD mydatabase:latest


**Example in Docker Compose File:**

yaml
version: '3.8'

services:
  myapp:
    image: myapp
    secrets:
      - secret: api_key
        as_env: APP_API_KEY

secrets:
  api_key:
    file: ./api_key


**Notes:**

- This solution enhances usability without compromising security by default.
- The feature is optional, allowing users to choose when to expose secrets as environment variables.
- It aligns with Kubernetes' approach, providing a familiar pattern for users transitioning between platforms.

Deploy with DigitalOcean

Use this fix in production instantly. Claim your $200 developer credit.

Get Started →