<p>I have a spring boot app which loads a yaml file at startup containing an encryption key that it needs to decrypt properties it receives from spring config.</p>

<p>Said yaml file is mounted as a k8s secret file at etc/config/springconfig.yaml</p>

<p>If my springboot is running I can still sh and view the yaml file with "docker exec -it 123456 sh" How can I prevent anyone from being able to view the encryption key?</p>

<p>You need to restrict access to the Docker daemon. If you are running a Kubernetes cluster the access to the nodes where one could execute <code>docker exec ...</code> should be heavily restricted. </p>
