When using docker with asp.net core for development, should I use user-secrets or environment variables? I am using the default docker file that Visual Studio 2017 creates when adding a project, which uses microsoft/aspnetcore:1.1 and I believe is a linux image.
How do I set the user-secrets/environment variables in docker so they are set when it launches, but aren't included in the source code?
For the production purpose, you need to use environment variables, not use-secrets. Secrets exist ONLY for safe storage during development by helping prevent sensitive data from being storing in code / checked into source control:
The Secret Manager tool does not encrypt the stored secrets and should not be treated as a trusted store. It is for development purposes only. The keys and values are stored in a JSON configuration file in the user profile directory.
As alternative to environment variables you may consider using "external" key-value storages, like Consul, Vault, etc.
Regarding environment variables in docker, SO already has related questions/answers. See How to pass environment variables to docker containers? as example.
Environment vars are better - https://12factor.net/config
If you run docker using docker run use -e or --env-file option:
https://docs.docker.com/engine/reference/run/#env-environment-variables
If you run docker using docker-compose use environment or env_file key:
https://docs.docker.com/compose/environment-variables/
For Development I rely on .net secret manager tool:
dotnet user-secrets init
dotnet user-secrets set "Movies:ServiceApiKey" "12345"
..
See MS docs: Safe storage of app secrets in development in ASP.NET Core.
Example for Docker:
docker run ^
-e ASPNETCORE_ENVIRONMENT=Development ^
-v %APPDATA%/Microsoft/UserSecrets:/root/.microsoft/usersecrets:ro ^
company/image:latest
Example for docker-compose:
version: "3.8"
..
net_core_service:
..
environment:
# should be defined Development-env to allow loading user-secrets located on the local computer.
- ASPNETCORE_ENVIRONMENT=Development
..
volumes:
# map the dotnet user-secret folder
- $APPDATA/Microsoft/UserSecrets:/root/.microsoft/usersecrets:ro
..
..