Feature request - Add interactive input password for secrets

[yhojann-cl]

The docker secrets is realy secret for other users or leak?

The use of the docker secret create command does not protect the security of the secrets before they are generated, because when they are entered through a CLI command, this can be recorded, for example, in .bash_history.

An awkward but useful solution was to add whitespace before the command, this prevented it from being saved in the command history, but in CentOS 8 this does not happen and is saved anyway.

[root@server ~]#    print dev | docker secret create mysql-root -;
[root@server ~]# exit
[root@server ~]# cat ~/.bash_history
    printf dev | docker secret create my_secret -
exit
[root@server ~]#

There is an option to delete the history of the bash but it is not a formal solution since if a user forgets to clean the history they will be able to expose passwords in their history.

In CLI, all the commands I know except for a docker that request a password do so in a hidden way through an interactive entry where the content is masked and invisible, for example:

• passwd command.
• mysqladmin root password set.
• ssh login.
• tty1 login.

Docker secrets are supposed to avoid sending passwords flat with docker compose or enviroment options, but creating this "secret" password requires exposing the password in logs or screen visibility. In the official documentation there is no option to hide this entry.

I have created a basic but ineffective solution:

while read -e line; do printf $line | docker secret create mysql-root -; break; done;

This makes entering the password interactive but not hidden on the screen. This can be added as aliases. It is a good idea to integrate an interactive option to create passwords or secrets, for example:

[root@server ~]# docker secret create mysql-root -i
hidden secret:
fg1tc9114100w2f2fpzvnp4zr