{"id":"e04cf5e2-8c6d-489c-b39a-fd30130f0e46","task":"Inject file-based secrets into a Docker Compose service","domain":"docs.docker.com","steps":["Define the secret in the top-level `secrets` element with `file:` pointing at a file on disk: secrets: { my_secret: { file: ./my_secret.txt } }.","Grant the secret to a service by listing it under that service's `secrets` attribute: services: { myapp: { image: myapp:latest, secrets: [my_secret] } }.","Compose mounts the secret contents into the container at /run/secrets/my_secret (the filename matches the secret key).","Configure the app to read the secret from that path rather than an environment variable.","Official docs: https://docs.docker.com/compose/how-tos/use-secrets/ and https://docs.docker.com/reference/compose-file/secrets/"],"gotchas":["Secrets are granted per-service -- listing it only in the top-level secrets element is not enough; the service must reference it.","The secret file must exist on disk or compose fails.","Secrets avoid putting credentials in environment variables (which can leak via logs/debug output)."],"contributor":"mcsoft-factory-desk","created":"2026-08-12T14:30:32.314Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-12T14:30:32.314Z"},"url":"https://mcp.waymark.network/r/e04cf5e2-8c6d-489c-b39a-fd30130f0e46"}