{
  "id": 4227277,
  "title": "Managing External Secrets in Docker Swarm",
  "url": "https://urgent.news/2026/08/29/managing-external-secrets-in-docker-swarm",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-29T16:14:01.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/artarts36/managing-external-secrets-in-docker-swarm-1jnl"
  },
  "original_language": "en",
  "account": "Managing External Secrets in Docker Swarm is a challenge that has been encountered by many developers. Docker Swarm secrets are immutable once created, meaning their values cannot be updated directly. When external secret stores change, such as a password or API key, there needs to be a method to propagate those changes to Docker Swarm. A typical solution involves creating new secrets with version or hash numbers in their names, but this can be cumbersome.\n\nThe author developed cloud-secrets to address this issue. The goal was to maintain the use of standard Docker secrets from the application's perspective, keep the application unaware of the external secret store, and ensure the secret is available at /run/secrets/database-password without altering the stack when its value is updated. The concept behind cloud-secrets is straightforward: it acts as a bridge between an external secret store and Docker Swarm.\n\nCloud-secrets operates on a Swarm manager and synchronizes external secrets with Docker Swarm. It regularly checks for changes and manages the Docker secret lifecycle when values change. The stack still references the same logical secret, but cloud-secrets manages the underlying process. Currently, HashiCorp Vault is supported as an external secret store.\n\nTo use cloud-secrets, an example is provided with Vault and AppRole. The services section in the Docker Compose file includes cloud-secrets running on an image from Swarm Deploy's repository. Volumes, environment variables, and other configurations are set up to connect to Vault securely. Secrets used by cloud-secrets, such as RoleID and SecretID, can also be provided as Docker secrets.\n\nThe complete setup of Vault and AppRole is not detailed in this post, but it is covered in the project's documentation. Users can follow the documentation themselves or delegate the setup to an AI agent. The post concludes by emphasizing the narrow scope of cloud-secrets and its primary function of keeping external secret stores in sync with Docker Swarm. The project is open source and available on GitHub, along with a guide to setting up Vault and Cloud Secrets. For those using external secrets with Docker Swarm, the author expresses interest in hearing about existing secret rotation practices.",
  "summary": "I've been working with Docker Swarm secrets and kept running into one limitation: secrets are immutable. Once a secret is created, you can't update its value. When a password, API key, or another secret changes in an external secret store, you need a way to propagate that change to Docker Swarm. A common approach is to create a new secret with a version or hash in its name: database-password-v1…",
  "key_points": [
    "Cloud-secrets bridges external secret stores with Docker Swarm.",
    "Maintains standard Docker secrets for applications.",
    "Supports HashiCorp Vault as external secret store."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}