Docker Secrets Management in Swarm Mode

By Admin · Mar 26, 2026 · Updated Apr 23, 2026 · 7 views · 3 min read

In this article, we'll walk through the complete process of working with secrets in a server environment. Understanding swarm is essential for maintaining a reliable and performant infrastructure.

Creating the Docker Compose File

When scaling this setup, consider vertical scaling (adding more RAM/CPU) first, as it's simpler to implement. Horizontal scaling adds complexity but may be necessary for high-traffic applications.


# docker-compose.yml
version: '3.8'
services:
  app:
    image: secrets:latest
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      - app_data:/data
    environment:
      - NODE_ENV=production
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3

volumes:
  app_data:

Note that file paths may vary depending on your Linux distribution. The examples here are for Debian/Ubuntu; adjust paths accordingly for RHEL/CentOS-based systems.

Building the Container Image

The default configuration works well for development environments, but production servers require additional tuning. Pay particular attention to connection limits, timeout values, and logging settings.


# Multi-stage Dockerfile
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
EXPOSE 3000
CMD ["node", "dist/index.js"]

These commands should be run as root or with sudo privileges. If you're using a non-root user, prefix each command with sudo.

Advanced Settings

Start with the minimum required resources
Use connection pooling for database connections
Profile before optimizing - measure first
Implement caching at every appropriate layer

Configuring Volumes and Networks

Performance benchmarks show that properly tuned secrets can handle significantly more concurrent connections than the default configuration. The key improvements come from adjusting worker processes and connection pooling.


# Container management commands
docker compose up -d
docker compose logs -f app
docker compose exec app sh
docker system prune -af --volumes  # Caution: removes unused data

Each line in the configuration serves a specific purpose. The comments explain the reasoning behind each setting, making it easier to customize for your specific use case.

Managing Container Lifecycle


# docker-compose.yml
version: '3.8'
services:
  app:
    image: secrets:latest
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      - app_data:/data
    environment:
      - NODE_ENV=production
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3

volumes:
  app_data: