I hope you are well. I have some questions about how Docker secrets can make the use of credentials in containers more secure and how to work with them correctly, given that their content is exposed in /run/secrets and can be easily accessed with cat both inside and outside the containers. Additionally, to run as a user with minimal permissions inside the container, I need to keep the permissions of the secret files open on the host machine, because if I set them as root-only, the non-root user inside the container will not be able to read their content and the application will not be able to work with the information.

This is how I have been working with secrets in my Docker Compose.

services:
  app:
    [...]
    depends_on:
      - db
    secrets:
      - postgres_db
      - postgres_server
      - postgres_user
      - postgres_password
    [...]
    networks:
      - app_net
      - db_net
  
  db:
    image: postgres:16.3-alpine3.20
    restart: always
    environment:
      POSTGRES_DB_FILE: /run/secrets/postgres_db
      POSTGRES_USER_FILE: /run/secrets/postgres_user
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
    secrets:
      - postgres_db
      - postgres_user
      - postgres_password
    [...]

secrets:
  postgres_db:
    file: ./secrets/postgres_db.txt
  postgres_server:
    file: ./secrets/postgres_server.txt
  postgres_user:
    file: ./secrets/postgres_user.txt
  postgres_password:
    file: ./secrets/postgres_password.txt