A secrets section is a top-level Docker Compose resource that declares named secrets and the files supplying them. A service can then mount a named secret at a target path inside its container, where the application reads it as configuration. section 10.3 section 7.4
Use a secrets section to:
- Define the secret required by a service; a service reference is invalid when its named secret is not declared. section 10.3
- Load sensitive configuration such as database connection strings, certificates, or API keys from a host file. section 7.4
- Keep the same image reusable across development, test, and other environments while changing the supplied configuration. section 7.4
Connect a service to a local secret file
Declare the source file at the top level, then reference the secret from the service. The container receives its contents at the application’s expected path: secrets: postgres-connection: file: ./config/secrets.json services: todo-web: secrets: - source: postgres-connection target: /app/config/secrets.json Start the Compose application with `docker compose up -d`, then verify its containers with `docker compose ps`. On Windows containers, use the platform-specific Compose file when file paths differ.
