Security on ads' corner

Docker Secrets and hiding sensitive information in Docker build output

Wed, 30 Jul 2025 00:00:00 +0200

While building a container, I need to pass a token into the build process. The container build step needs to download a package using said secret token - and that token is part of the URL. The token will show up on the screen, and potentially in any logfile. Not good.

Note: This applies to docker compose (and docker buildx).

The step in the Dockerfile looks like this:

1

RUN curl -1Lfs "https://website.example/verysecrettoken/setup.rpm" -o /root/setup.sh

And shows up in the build output on the screen, and in the log:

Create and renew Let's Encrypt certificates using Ansible - and the acme_certificate module

Tue, 24 Mar 2020 18:45:00 +0100

About two years ago I blogged about how to create and renew Let’s Encrypt certificates using Ansible. Back then, the “letsencrypt” module was State of the Art. This changed, and with all the Let’s Encrypt API changes, the Ansible module changed quite a lot, and is now “acme_certificate”. ACME stands for: Automatic Certificate Management Environment, and is the idea that every step along the way of creating and renewing certificates should be automated. No more manual creation of CSR (Certificate Signing Request), sending them per mail or manually uploading them to a CA website, enter your credit card details, and at some point get a mail back with the new signed certificate. All of this (except the credit card - you no longer need one) can be automated, and handled in a matter of seconds.

Time to write an updated blog post for the new module.

Create and renew Let's Encrypt certificates using Ansible

Sun, 27 May 2018 22:41:00 +0200

Update: Blog post using the acme_certificate module can be found here.

Ansible comes with a plugin which allows to create and renew Let’s Encrypt certificates. Documentation is sparse, so I decided to post about my own Playbook.