Feature request: allow config.json to be provided as a Docker secret. #143

New Issue

saavagebueno · 2025-11-20T04:20:52-05:00

saavagebueno commented

2025-11-20 04:20:52 -05:00

Originally created by @fresh2dev on GitHub (Sep 21, 2021).

Originally assigned to: @qdm12 on GitHub.

What's the feature?

allow config.json to be provided as a Docker secret (by providing a new CLI parameter, or environment variable).

Extra information?

When using Docker Swarm, the most secure way to provide sensitive information to containers is using Docker secrets. Secrets are mounted into containers at the path /run/secrets/<name>. See the example here.

Using the Docker image, qmcgaw/ddns-updater, there is no way to create a Docker secret of config.json and reference it in the container at the path /run/secrets/....

I tried setting DATADIR=/run/secrets, but this doesn't work because the path is not writable for update.json.

In this scenario, I usually resort to modifying the container entrypoint logic to symlink/copy the secret file to the expected path before invoking the app. However, I'm unable to do that with this image because there is no shell available.

For this to be possible, this app/image would need to do at least one of the following:

make a shell available in the image (so the user can override the entrypoint before invoking the app)
make the app respect a parameter, e.g., app --config-file /run/secrets/config.json
make the app respect an env var, e.g., CONFIG_FILE=/run/secrets/config.json

This would make the app/image more secure and also more portable since it could then rely on Docker secrets/volumes for config.json instead of a host-bind mount, eliminating the need to perform step 1 of the ddns-updater setup.

Originally created by @fresh2dev on GitHub (Sep 21, 2021). Originally assigned to: @qdm12 on GitHub. 1. What's the feature? allow `config.json` to be provided as a Docker secret (by providing a new CLI parameter, or environment variable). 2. Extra information? When using Docker Swarm, the most secure way to provide sensitive information to containers is using [Docker secrets](https://docs.docker.com/engine/swarm/secrets/). Secrets are mounted into containers at the path `/run/secrets/<name>`. See the example [here](https://docs.docker.com/engine/swarm/secrets/#use-secrets-in-compose). Using the Docker image, `qmcgaw/ddns-updater`, there is no way to create a Docker secret of `config.json` and reference it in the container at the path `/run/secrets/...`. I tried setting `DATADIR=/run/secrets`, but this doesn't work because the path is not *writable* for `update.json`. In this scenario, I usually resort to modifying the container entrypoint logic to symlink/copy the secret file to the expected path before invoking the app. However, I'm unable to do that with this image because there is no shell available. For this to be possible, this app/image would need to do *at least one* of the following: - make a shell available in the image (so the user can override the entrypoint before invoking the app) - make the app respect a parameter, e.g., `app --config-file /run/secrets/config.json` - make the app respect an env var, e.g., `CONFIG_FILE=/run/secrets/config.json` This would make the app/image more secure and also more portable since it could then rely on Docker secrets/volumes for `config.json` instead of a host-bind mount, eliminating the need to perform [step 1 of the ddns-updater setup](https://github.com/qdm12/ddns-updater#setup).

saavagebueno added the Category: Good idea 🎯 label 2025-11-20 04:20:52 -05:00

saavagebueno closed this issue

2025-11-20 04:20:52 -05:00

saavagebueno commented

2025-11-20 04:20:53 -05:00

@qdm12 commented on GitHub (Jun 17, 2024):

My apologies for the MASSIVE delay visiting this issue.
This is done in ca85596e19 with the env variable CONFIG_FILEPATH. By default it's DATADIR + config.json, but you can now set it to i.e. /run/secrets/config.json.

@qdm12 commented on GitHub (Jun 17, 2024): My apologies for the MASSIVE delay visiting this issue. This is done in ca85596e195622b378ff9b09ccf80572ac6d65f3 with the env variable `CONFIG_FILEPATH`. By default it's `DATADIR` + config.json, but you can now set it to i.e. `/run/secrets/config.json`.

saavagebueno referenced this issue

2025-11-20 04:25:29 -05:00

[PR #144] [MERGED] Linode support #625

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ddns-updater#143

Feature request: allow config.json to be provided as a Docker secret. #143

Feature request: allow `config.json` to be provided as a Docker secret. #143