title: Why are Docker Secrets considered safe?
body: <p>I read about <a href="https://docs.docker.com/engine/swarm/secrets/" rel="noreferrer">docker swarm secrets</a> and did also some testing.
  As far as I understood the secrets can replace sensitive environment variables provided in a docker-compose.yml file (e.g. database passwords). As a result when I inspect the docker-compose file or the running container I will not see the password. That's fine - but what does it really help?</p>
  
  <p>If an attacker is on my docker host, he can easily take a look into the /run/secrets </p>
  
  <pre><code>docker exec -it df2345a57cea ls -la /run/secrets/
  </code></pre>
  
  <p>and can also look at the data inside:</p>
  
  <pre><code>docker exec -it df27res57cea cat /run/secrets/MY_PASSWORD
  </code></pre>
  
  <p>The same attacker can mostly open a bash on the running container and look how its working....</p>
  
  <p>Also if an attacker is on the container itself he can look around.</p>
  
  <p>So I did not understand why docker secrets are more secure as if I write them directly into the docker-compose.yml file?</p>