This article is based on reporting originally published by CRN in February 2017, covering a Docker Datacenter release that introduced native secrets management and image security scanning.
Overview
Docker released an update to Docker Datacenter—its enterprise Containers-as-a-Service platform—that introduced two significant security capabilities: a container-native secrets management framework and a Docker image security scanning feature. Together, these addressed long-standing concerns from enterprise customers about securely handling sensitive credentials in containerized environments.
The Problem: Secrets in Plain Sight
Before Docker built secrets management into the platform, teams running containers at scale had no native, secure way to pass sensitive information—passwords, API keys, private keys, database credentials—to the containers that needed them. Common workarounds included embedding credentials in environment variables, baking them into Docker images, or relying on third-party secrets stores that added operational complexity and potential exposure points.
Will Kinard, CTO of BoxBoat (a Docker partner based in Washington, D.C.), described the situation plainly in comments to CRN:
“This was a challenge before it was built into the platform. We had to pass in passwords in the clear without encryption.”
Will Kinard, CTO, BoxBoat
How Docker Secrets Management Works
The secrets management feature is integrated directly into Docker Swarm, the built-in cluster orchestration layer. Key characteristics of the implementation include:
- Encrypted storage: Secrets are stored as encrypted key-value pairs within the Swarm cluster’s distributed store (backed by Raft consensus).
- Granular access control: Only explicitly authorized services within the cluster can access a given secret. Containers that do not need a secret cannot retrieve it.
- Supported secret types: Login credentials, database passwords, TLS/private keys, API tokens, and other sensitive strings.
- Runtime delivery: Secrets are delivered to authorized containers at runtime, mounted as files in an in-memory tmpfs filesystem inside the container, so they are never written to disk on the host or baked into an image layer.
Kinard summarized the intent of the feature: “This is providing access to secrets to the containers that need it, and depriving it to containers that don’t.”
Image Security Scanning
Alongside secrets management, the Docker Datacenter update also shipped a security scanning feature for Docker images. This capability:
- Scans Docker images layer by layer and cross-references their contents against known vulnerability databases.
- Identifies both security vulnerabilities (CVEs) and non-security bugs in packages and libraries bundled inside images.
- Helps teams catch problematic dependencies before images are deployed to production.
According to Kinard, even organizations new to Docker were already asking about security scanning capabilities, underscoring its importance as an enterprise requirement.
Why This Mattered for DevOps Teams
Managing secrets securely is a cross-cutting concern that affects every team in the DevOps lifecycle—developers writing application code, operators managing cluster infrastructure, and security teams enforcing compliance policies. By building secrets management natively into the orchestration layer rather than relying on bolt-on tooling, Docker aimed to:
- Reduce the attack surface by eliminating cleartext credential passing.
- Simplify the developer experience—services declare what secrets they need; Swarm handles secure delivery.
- Enable partners and enterprises to build end-to-end secure container solutions without mandatory third-party integrations.
- Improve auditability and access control at the orchestration layer.
Context: Docker Datacenter and the Enterprise Market
Docker Datacenter was Docker’s first commercial product, positioning the company in the enterprise market with a Containers-as-a-Service offering. Docker had also launched its first formal channel partner program around Datacenter, making enterprise security features like secrets management and image scanning important selling points for partners and system integrators.
The secrets management and scanning features represented Docker’s move toward making security a first-class platform capability rather than an afterthought, directly responding to feedback from enterprise customers evaluating container adoption at scale.
Legacy and Current State
Docker Secrets (introduced in Docker 1.13 / Docker Swarm) remains available in Docker Swarm deployments today. For teams using Kubernetes, the equivalent mechanism is Kubernetes Secrets, though both Kubernetes and Docker ecosystems now commonly integrate with dedicated secrets management solutions such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault for more advanced use cases like secret rotation and fine-grained audit logging.
Image scanning has similarly evolved, with tools such as Docker Scout, Trivy, Grype, Snyk, and cloud-provider native scanners now offering more comprehensive vulnerability detection pipelines.