Docker secrets not accounting for remote context

Viewed 235

I am using docker contexts to deploy an application (3 containers ... web/postgres/nginx) from Windows 10 to a remote Ubuntu 20.04 server using a 3.8 docker-compose.yml file. The remote context is type moby and the endpoint is ssh://swright@xxx.xxxxxx.xxx. The orchestrator is swarm but I have not implemented that.

Everything worked perfectly until I added secrets. The web container now can't be created because it says I have an invalid mount path ('C:/run/secrets/secret_key.txt' mount path must be absolute).

Creating plantweb ... error

ERROR: for plantweb  Cannot create container for service web: invalid mount config for type "bind": invalid mount path: 'C:/run/secrets/secret_key.txt' mount path must be absolute

That it is looking for the secret file on C: tells me it is trying to mount a local Windows file when it should be mounting the /run/secrets/secret_key.txt file I created on the remote.

Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-67-generic x86_64)Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-67-generic x86_64)
...
Last login: Wed Mar 24 17:59:40 2021 from 70.51.98.164
swright@ubuntu2:~$ cd /run/secrets
swright@ubuntu2:/run/secrets$ ls
plant_api_key.txt  secret_key.txt  sendgrid_api_key.txt  sendgrid_default_from_email.txt  sql_password.txt  sql_user.txt
swright@ubuntu2:/run/secrets$

I believe I've done exactly what is described in the docker documentation regarding secrets. Could there be a bug in docker that secrets don't respect the context I'm in? Or have I done something wrong?

This is my yml file.

version: '3.8'
services:
  web:
    container_name: plantweb
    restart: always
    build: ./django-plants/
    volumes:
      - static_volume:/usr/src/app/static
      - media_volume:/usr/src/app/media
    secrets:
      - secret_key
      - sql_user
      - sql_password
      - plant_api_key
      - sendgrid_api_key
      - sendgrid_default_from_email      
    env_file:
      - ./.env.prod
    expose:
      - 8000
    networks:
      - nginx_network
      - plants_network
    depends_on:
      - db
 
<snip ...>
  
secrets:
  secret_key:
    file: /run/secrets/secret_key.txt
  sql_user:
    file: /run/secrets/sql_user.txt
  sql_password:
    file: /run/secrets/sql_password.txt
  plant_api_key:
    file: /run/secrets/plant_api_key.txt
  sendgrid_api_key:
    file: /run/secrets/sendgrid_api_key.txt
  sendgrid_default_from_email:
    file: /run/secrets/sendgrid_default_from_email.txt

docker-compose config returns this, no matter what context I'm using (local or remote).

<snip>
secrets:
  plant_api_key:
    file: C:\run\secrets\plant_api_key.txt
  secret_key:
    file: C:\run\secrets\secret_key.txt
  sendgrid_api_key:
    file: C:\run\secrets\sendgrid_api_key.txt
  sendgrid_default_from_email:
    file: C:\run\secrets\sendgrid_default_from_email.txt
  sql_password:
    file: C:\run\secrets\sql_password.txt
  sql_user:
    file: C:\run\secrets\sql_user.txt
<snip>
0 Answers
Related