Secrets Off the Env

Replace an env-var password with a read-only file-based secret.

A advanced Docker challenge worth 20 points. Solve it hands-on in a real Docker environment in your browser - no local setup, no fake shells.

The Challenge

Scenario: Audit finding: the CRM database password is a plain env var — anyone who can docker inspect crm-api reads it. (Try it.)

Tasks: move it to the file-based pattern every orchestrator uses:

• Put hunter2prod in /root/secrets/db_password
• Recreate crm-api (alpine, sleep infinity) with:
• no DB_PASSWORD env var
• the secret file mounted read-only at /run/secrets/db_password
• env DB_PASSWORD_FILE=/run/secrets/db_password

Commands to learn: -v file:file:ro, the *_FILE convention, secret hygiene

Run check when done.