I was trying to understand Docker secret functionality and had one query. Suppose our container is running a vulnerable microservice like PHP server which is susceptible to RCE. Can somebody attack my container through the IP address and gain a shell to my container? If yes can the attacker cat the contents of the secret file which is mounted?
Short answer: yes. The Docker documentation says:
Secrets are encrypted during transit and at rest... Here
, which is exactly what it is supposed to be. And rest in this case means: While it is not used by the docker container.
But if your running software needs to read the secrets (such as an SSH key) it has to be decrypted. This means that in every case the secret gets mounted to a docker container it will be decrypted. And given this scenario every attacker who has shell access will be able to read this as well. This is not what docker tries to protect you from. See also: Docker Secrets
If an attacker roots your container I would say that he is able to see what's inside the file, since according to the documentation, the file is mounted unencrypted on the container:
When you grant a newly-created or running service access to a secret, the decrypted secret is mounted into the container in an in-memory filesystem. The location of the mount point within the container defaults to /run/secrets/ in Linux containers, or C:\ProgramData\Docker\secrets in Windows containers. You can specify a custom location in Docker 17.06 and higher.
It also says that:
You can update a service to grant it access to additional secrets or revoke its access to a given secret at any time.
Maybe you could revoke access after your process loaded the secret in memory so the file is not attached to the container anymore.
Link to the documentations for 17.09 https://docs.docker.com/engine/swarm/secrets/#how-docker-manages-secrets