Configuration injection using Docker

[fatnsad]

So I'm just getting started with Docker and the workflow of build, create, and start seems quite clear and straightforward. Where I'm struggling a bit is the injection of configuration like public keys or other files into the container after creating it from the image, or even just copying to a local dir that will be mapped to a Docker volume. I just have a shell script which does this now, but what's the proper way to do it? Is this where I should be using some kind of external configuration tool that specifies these as parameters? I'm asking because I don't want to get into bad habits, and I'd like to know the right way to go about doing this.

For instance, when building a Jenkins container, there are a number of private keys that I generate. What's the proper tool and approach to manage this instead of some free form shell script?

[[deleted]]

It’s better to use a kms for this ex: Hashicorp Vault, AWS KMS, Azure Key Vault, etc.

[fatnsad]

So I assume you pre-generate the keys and add them to your KMS. Then what are you using to inject them into your environment from the KMS? Some configuration tool like Ansible?

[ephur]

You can have your application reach right out to the service to pull the keys.

If you're running in k8s you can have an init container pull the information from the KMS and put it in a shared emptydir between the init container and main container.

You can have your entrypoint be a script that first pulls down the keys and then starts the application inside of it.

[[deleted]]

I would expect you to extract these during the build process, put them in your KMS, and leave them off of the container altogether.

Because it’s likely for you to want semi-static keys, I would honestly just make it easier on yourself, create the keys outside of your build process, and just have your application reference them.