Published on

Use Docker Secrets with MySQL on Docker Swarm

Authors

Today we will use Docker Secrets, more specifically store our MySQL Passwords in Secrets, which will be passed to our containers, so that we don't use clear text passwords in our Compose files.

What is Docker Secrets:

In Docker, Docker Secrets are encrypted during transit and at rest in a Docker Swarm Cluster. The great thing about Docker Secrets is that you can manage these secrets from a central place, and the fact that it encrypts the data and transfers the data securely to the containers that needs the secrets. So you authorize which containers needs access to these secrets.

So instead of setting the MySQL Root Passwords in clear text, you will create the secrets, then in your docker-compose file, you will reference the secret name.

Deploy MySQL with Docker Secrets

We will deploy a Stack that contains MySQL and Adminer (WebUI for MySQL).

We will make the MySQL Service Persistent by setting a constraint to only run on the Manager node, as we will create the volume path on the host, and then map the host to the container so that the container can have persistent data. We will also create secrets for our MySQL Service so that we dont expose any plaintext passwords in our compose file.

Our Docker Compose file:

docker-compose.yml
version: '3.3'

services:
  db:
    image: mysql
    secrets:
      - db_root_password
      - db_dba_password
    deploy:
      replicas: 1
      placement:
        constraints: [node.role == manager]
      resources:
        reservations:
          memory: 128M
        limits:
          memory: 256M
    ports:
      - 3306:3306
    environment:
      MYSQL_USER: dba
      MYSQL_DATABASE: mydb
      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
      MYSQL_PASSWORD_FILE: /run/secrets/db_dba_password
    networks:
      - appnet
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - type: bind
        source: /opt/docker/volumes/mysql
        target: /var/lib/mysql

  adminer:
    image: adminer
    ports:
      - 8080:8080
    networks:
      - appnet

secrets:
  db_root_password:
    external: true
  db_dba_password:
    external: true

networks:
  appnet:
    external: true

Dependencies:

As we specified our secrets and networks as external resources, it needs to exist before we deploy our stack. We also need to create the directory for our mysql data, as the data will be mapped from our host to our container.

Create the Overlay Network:

docker network create --driver overlay appnet

Create the Secrets:

openssl rand -base64 12 | docker secret create db_root_password -
openssl rand -base64 12 | docker secret create db_dba_password -

List the Secrets:

docker secret ls

ID                          NAME                CREATED             UPDATED
jzhrwyxkiqt8v81ow0xjktqnw   db_root_password    12 seconds ago      12 seconds ago
plr6rbrqkqy7oplrd21pja3ol   db_dba_password     4 seconds ago       4 seconds ago

Inspect the secret, so that we can see that theres not value exposed:

docker secret inspect db_root_password

The output:

[
    {
        "ID": "jzhrwyxkiqt8v81ow0xjktqnw",
        "Version": {
            "Index": 982811
        },
        "CreatedAt": "2017-11-23T14:33:17.005968748Z",
        "UpdatedAt": "2017-11-23T14:33:17.005968748Z",
        "Spec": {
            "Name": "db_root_password",
            "Labels": {}
        }
    }
]

Create the Directory for MySQL:

mkdir -p /opt/docker/volumes/mysql

Deployment Time!

Deploy the stack:

docker stack deploy -c docker-compose.yml apps

Creating service apps_adminer
Creating service apps_db

As you can see the data of our MySQL container resides on our host, which makes the data persistent for the container:

ls /opt/docker/volumes/mysql/

auto.cnf  ca-key.pem  ca.pem  client-cert.pem  client-key.pem  ib_buffer_pool  ibdata1  ib_logfile0  ib_logfile1  ibtmp1  mydb  mysql  performance_schema  private_key.pem  public_key.pem  server-cert.pem  server-key.pem  sys

Connect to MySQL

The value of our secrets will reside under /run/secrets/ in our container, as we have mapped it to our mysql container, lets have a look at them:

docker exec -it $(docker ps -f name=apps_db -q) ls /run/secrets/

db_dba_password  db_root_password

View the actual value of the db_root_password:

docker exec -it $(docker ps -f name=apps_db -q) cat /run/secrets/db_root_password

mRpcY1eY2+wimf10

Connecting to MySQL:

docker exec -it $(docker ps -f name=apps_db -q) mysql -u root -p

Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 8
Server version: 5.7.20 MySQL Community Server (GPL)

Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mydb               |
| mysql              |
| performance_schema |
| sys                |
+--------------------+
5 rows in set (0.00 sec)

As we have deployed adminer, you can access the Adminer WebUI on the Host's IP and the Defined Port.

Testing Data Persistance:

docker exec -it $(docker ps -f name=apps_db -q) mysql -u root -p

Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.

mysql> create database ruan;
Query OK, 1 row affected (0.00 sec)

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mydb               |
| mysql              |
| performance_schema |
| ruan               |
| sys                |
+--------------------+
6 rows in set (0.00 sec)

mysql> exit;
Bye

Verify the hostname of our container, before we kill the container:

docker exec -it $(docker ps -f name=apps_db -q) hostname

bdedb54bbc2b

Kill the container:

docker kill $(docker ps -f name=apps_db -q)

bdedb54bbc2b

Verify the status of the MySQL Service, as we can see the service count is 0, so the container was succesfully killed.

docker service ls -f name=apps_db

ID                  NAME                MODE                REPLICAS            IMAGE               PORTS
nzf96q05fktm        apps_db             replicated          0/1                 mysql:latest        *:3306->3306/tcp

After waiting for a couple of seconds, we can see the service is in service again, then check the hostname so that we can confirm that its a new container:

docker service ls -f name=apps_db

ID                  NAME                MODE                REPLICAS            IMAGE               PORTS
nzf96q05fktm        apps_db             replicated          1/1                 mysql:latest        *:3306->3306/tcp

Exec into the container and list the hostname:

docker exec -it $(docker ps -f name=apps_db -q) hostname

95c15c89f891

Logong to MySQL again and verify if our perviously created database is still there:

docker exec -it $(docker ps -f name=apps_db -q) mysql -u root -p

Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mydb               |
| mysql              |
| performance_schema |
| ruan               |
| sys                |
+--------------------+
6 rows in set (0.01 sec)

By design docker is stateless, but as we mapped the host's path to the container our data is persistent. As we have set a constraint so that the container must only spin up on this node, the container will always have access to the data path.

Thank You

Thanks for reading, feel free to check out my website, feel free to subscribe to my newsletter or follow me at @ruanbekker on Twitter.

Discuss on Twitter • View on GitHub