Piye carane nangani konfigurasi lan rahasia ing Docker?

Question

Accepted Answer

Aplikasi sing dinggo-kontainerisir kudu bisa **dikonfigurasi** tanpa mbangun ulang gambar — nggunakake **variabel lingkungan**, file konfigurasi, lan **manajemen rahasia** sing bener. Nangani konfigurasi lan rahasia kanthi bener penting banget kanggo keamanan lan kanggo ndadekake gambar sing padha bisa gawe ing macem-macem lingkungan.

## Konfigurasi liwat variabel lingkungan (12-factor)

```bash
# pass config at RUNTIME via environment variables (not baked into the image)
docker run -e DATABASE_URL=postgres://... -e NODE_ENV=production myapp
docker run --env-file .env myapp        # load many from a file
```

```yaml
# in docker-compose.yml
services:
  app:
    image: myapp
    environment:
      - DATABASE_URL=postgres://db:5432/app
    env_file: .env
```

Ngetutake prinsip **twelve-factor**, konfigurasi teka saka **lingkungan** (variabel env) nalika runtime — dadi gambar SING PADHA bisa gawe ing dev, staging, lan production karo konfigurasi beda, ora perlu mbangun ulang saben lingkungan.

## Rahasia: ORA BOLEH disusup ing gambar

```text
⚠️ NEVER put secrets (passwords, API keys, tokens) in the Dockerfile or image layers:
  → image layers are inspectable → secrets can be EXTRACTED (even if "removed" later,
    they remain in earlier layers)
  → anyone with the image gets the secrets
→ This is a serious, common security mistake.
```

## Manajemen rahasia sing bener

```text
✓ RUNTIME environment variables (better than image, but visible in inspect/env)
✓ DOCKER SECRETS (Swarm) / Kubernetes Secrets — mounted securely at runtime
✓ Secrets MANAGERS — HashiCorp Vault, AWS Secrets Manager, etc. (fetch at runtime)
✓ BuildKit build secrets (--secret) — for build-time secrets without baking into layers
✓ Keep .env files OUT of version control (.gitignore) and out of the image (.dockerignore)
```

## Apa gunane

Nangani konfigurasi lan rahasia kanthi bener ing Docker penting banget kanggo **keamanan** lan **fleksibilitas operasional**, dadi iku pengetahuan praktis sing berharga.

Prinsip konfigurasi — nyedhiakake konfigurasi liwat **variabel lingkungan nalika runtime** ketimbang disusup ing gambar (ngetutake prinsip twelve-factor) — penting banget karena bisa ndadekake **gambar sing padha bisa gawe ing kabeh lingkungan** (dev, staging, production) karo konfigurasi beda, ora perlu mbangun ulang saben lingkungan, apa iku standar utama kanggo deployment sing bisa diulang lan portable lan praktek dasar containerization.

Lebih kritis maneh, **manajemen rahasia** iku kekhawatiran keamanan sing serius: aturan kunci — **ora boleh disusup rahasia (password, API key, token) ing gambar** — essential banget karena lapisan gambar bisa diperiksa lan rahasia sing disusup bisa **dicongok** (lan tetep ana ing lapisan sebelume sanajan "dibusak" nanti), dadi sapa wae sing duwe gambhar iku bisa dapat rahasiamu; iki kesalahan sing umum lan berbahaya banget sing nyebabake kebocoran kredensyal nyata.

Nerangake **manajemen rahasia sing bener** — variabel lingkungan nalika runtime (luwih apik, senajan katon ing inspect), mekanisme rahasia khusus (Docker/Kubernetes Secrets sing dipasang aman, manajer rahasia kaya Vault utawa AWS Secrets Manager sing dicukup nalika runtime, BuildKit build secrets kanggo kabutuhan build-time), lan nyimpen file `.env` adoh saka version control lan gambar — iku perlu banget kanggo njaga rahasia kanthi aman.

Dadine ndadekake gambar sing padha bisa gawe ing macem-macem lingkungan (liwat konfigurasi berbasis env) lan njaga rahasia (ora boleh disusup ing gambar) loro-lorone penting banget kanggo deployment containerized sing aman lan fleksibel, lan aspek rahasianya utamane iku pengetahuan keamanan kritis sing nyegah kebocoran kredensyal nyata, nerangake konfigurasi lan manajemen rahasia ing Docker — konfigurasi berbasis lingkungan lan manajemen rahasia sing bener — iku pengetahuan praktis penting banget kanggo mendeploy container kanthi aman lan fleksibel, karo aspek rahasia utamane iku pengetahuan keamanan kritis.