TechPrufer
Get started
Shopify
Shopify logoShopify · Feature trail

Secrets Management in Containers

1 post · May 2015

What this trail covers

Shopify has evolved its approach to managing application secrets within containerized environments. Initial efforts focused on moving away from Chef's encrypted data bags due to limitations in security, auditing, and compatibility with containerization. The introduction of EJSON provided a solution for encrypting secrets with asymmetric encryption, allowing developers to manage secrets alongside their code. Subsequent development focused on secure key management and integration with container init processes.

All Shopify trails
  1. Secrets at Shopify - Introducing EJSON - ShopifyThis post introduces EJSON, a library for encrypting secrets within JSON files using asymmetric encryption. It details the motivation for moving away from Chef's symmetric encryption, including issues with key management, synchronous deployment, auditing, and containerization. The post explains how EJSON works, including the use of public/private keys and the `ejson` command-line utility. It also describes the key management process, where secrets are re-encrypted with a single 'infrastructure' key for runtime decryption within containers, and the challenges and solutions for securely inserting and revoking decryption keys during container startup.