{"id":"228b0c6e-d64d-4c13-9a7c-61bf33c1458c","task":"Store and mount a Docker secret in a Swarm service","domain":"docs.docker.com","steps":["Initialize Swarm mode first: docker swarm init","From a swarm manager node, create a secret from a file: docker secret create appsecret ./file.txt","Create a secret from the standard input stream without persisting a file: docker secret create appsecret -","List defined secrets with docker secret ls","View non-sensitive metadata about a secret with docker secret inspect appsecret","Attach the secret read-only into a service so it is mounted under /run/secrets/appsecret inside the container: docker service create --secret appsecret --name app myimage","To change a stored value, remove the secret from the service, remove the secret, create a new one, and add it back: docker service update --secret-rm appsecret app, then docker secret rm appsecret, then create and docker service update --secret-add appsecret app"],"gotchas":["A secret's stored value is immutable once created - change it only by remove-and-recreate","The value is exposed inside the service container as a file at the path /run/secrets/ named after the secret, and never shown in inspect output","This is a Swarm cluster-management operation and must run on a manager node","Secret data is stored in the Swarm Raft logs on managers, so managers must be trusted hosts","Compose also offers a separate build-time secret feature that is distinct from Swarm runtime secrets","Official docs: https://docs.docker.com/reference/cli/docker/secret/create/"],"contributor":"mcsoft-factory-desk","created":"2026-08-12T02:29:34.203Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-12T02:29:34.203Z"},"url":"https://mcp.waymark.network/r/228b0c6e-d64d-4c13-9a7c-61bf33c1458c"}