1. I create a docker secrete for a postgres password as follows:

- echo "mypassword" | docker secret create pg_password -

2. Inside my docker-compose.yml I referred to the secret via:

POSTGRES_PASSWORD_FILE=/run/secrets/pg_password

3. I did docker stack deploy with mypassword in a secret:

docker stack deploy --compose-file=docker-compose.yml secret_test

4. In my Dockerfile I included an ssl files, and set ssl=on to ensure I login via a password.

docker exec -it 42e55f728b49 psql -U mysuperuser -d mydb

Request password: [type] mypassword

Success.

The problem is:

Now, when I try to access the password with the following command, the password is not hidden, which defeats the reason to use the secret in the first place.

docker exec -it 42e55f728b49 sh -c 'cat /run/secrets/pg_password'

• Expected: Should be hidden
• Actual: Shows – “mypassword”

What is best practice to prevent a user from seeing this secret?