Introduction

This is part 3 about using an Ansible vault as a safe key store for sensitive variables for Docker compose files and maybe Dockhand.

In part 2 it is explained how an Ansible vault can be used.

In this article it is explored how to hide sensitive variables in (GUI) applications, like Dockhand.

Hide sensitive variables in applications

Let's start with the compose file, that was used before:

services:
  whoami:
    image: traefik/whoami
    container_name: whoami${ID:?ID required variable}
    ports:
      - 8090:80
    restart: unless-stopped

    environment:
      - POSTGRES_USER=${VAULT_POSTGRES_USER:?POSTGRES_USER to be populated in dockhand}
      - POSTGRES_PASSWORD=${VAULT_POSTGRES_PASSWORD:?VAULT_POSTGRES_PASSWORD to be populated in dockhand}
      - POSTGRES_DB=dockhand
      - DCKR_TEST=${VAULT_DCKR_TEST:-unused}
      - DCKR_STND=${COMPOSE_PROJECT_NAME}

The difficulty is that the variables must be hidden when the container is operational, that means that the right hand variables have been resolved and can no longer be recognized by their name starting with VAULT_.

The operational environment section from the compose file above will look like this:

    environment:
      DCKR_STND: whoami02
      DCKR_TEST: unused
      POSTGRES_DB: dockhand
      POSTGRES_PASSWORD: pg_pass
      POSTGRES_USER: pg_pass

The variables to possibly exclude are: POSTGRES_USER, POSTGRES_PASSWORD and DCKR_TEST. Possibly, because if the variable is not stored in the vault, it does not need to hidden. Let's see if that could be done.

To make it a bit more challenging the vault contains some VAULT_ strings in commented out lines:

# Secret variables to be included in the Docker file
#
A=1  # Prepend the variables with VAULT_:
     # - so it is clear in the compose file, where the variable was defined
     # - Dockhand can determines which variables to hide in the GUI
     # - Dummy comment to include _VAULT
VAULT_TAG=v1.23
VAULT_VAR=ans-var
VAULT_POSTGRES_USER=pg_user
VAULT_POSTGRES_PASSWORD=pg_pass

With the following script Dockhand simulator, the environment section becomes:

name: whoami02
services:
  whoami:
    container_name: whoami02
    environment:
      DCKR_STND: whoami02
      DCKR_TEST: unused
      POSTGRES_DB: dockhand

From this it can determined that POSTGRES_USER and POSTGRES_PASSWORD are correctly hidden. Although it looks like DCKR_TEST should be hidden as well, it isn't because the right- hand variable VAULT_DCKR_TEST is not stored in the vault.

A different way to verify the effect of the simulation script is to compare the output from docker-compose-vault config and the simulation script:

docker-compose-vault config > config.out
./dockhand-simulator > config.app

Clean up the output file config.app a little so it can be used to compare the outputs, and compare the outputs:

diff config.out config.app

The result is:

9,10d8
<       POSTGRES_PASSWORD: pg_pass
<       POSTGRES_USER: pg_user

That is the desired output.

Conclusion

It seems possible to use an Ansible vault to store sensitive variables securely, and use them securely by Docker compose and have them hidden by an application like Dockhand.