TechPrufer
Sign inGet started

Blogs›Shopify›Secrets Management in Containers

Secrets Management in Containers

Secrets Management in Containers

1
posts
2015

This feature thread tracks the development and enhancement of Shopify's approach to managing application secrets within containerized environments. Initial efforts focused on moving away from Chef's encrypted data bags due to limitations in security, auditing, and compatibility with containerization. The introduction of EJSON provided a solution for encrypting secrets with asymmetric encryption, allowing developers to manage secrets alongside their code. Subsequent development focused on secure key management and decryption processes within Docker containers, including the use of custom init processes and capabilities like CAP_SYS_ADMIN. Recent efforts involve attaching metadata to secrets for easier auditing and rotation, and exploring schema enforcement via CI checks.

2015

Secrets at Shopify - Introducing EJSON - Shopify

5/26/2015

This post introduces EJSON, a library for encrypting secrets within JSON files using asymmetric encryption. It details the motivation for creating EJSON, including the limitations of previous methods like Chef's encrypted data bags. The post explains how EJSON works, including the encryption process and the use of public/private key pairs per project. It also outlines the key management strategy for Docker containers, focusing on securely provisioning decryption keys and decrypting secrets at runtime within the container's init process before the application starts. The post also touches on attaching metadata to secrets for improved auditing and rotation.