{"id":617,"date":"2026-10-03T12:00:00","date_gmt":"2026-10-03T12:00:00","guid":{"rendered":"https:\/\/konteynerium.com\/index.php\/2026\/10\/03\/docker-secrets-gizli-bilgi-yonetimi-build-ve-runtime\/"},"modified":"2026-10-03T12:00:00","modified_gmt":"2026-10-03T12:00:00","slug":"docker-secrets-gizli-bilgi-yonetimi-build-ve-runtime","status":"publish","type":"post","link":"https:\/\/konteynerium.com\/index.php\/2026\/10\/03\/docker-secrets-gizli-bilgi-yonetimi-build-ve-runtime\/","title":{"rendered":"Gizli Bilgi Y\u00f6netimi: Build Secrets ve Compose Secrets"},"content":{"rendered":"

Parolalar, API anahtarlar\u0131 ve token’lar… Container d\u00fcnyas\u0131nda bunlar\u0131 yanl\u0131\u015f yere koyman\u0131n en kolay yolu ENV<\/code> ya da ARG<\/code> kullanmakt\u0131r, ve en tehlikeli yolu da budur. Bu yaz\u0131da \u00f6nce neden tehlikeli oldu\u011funu ger\u00e7ek bir deneyle g\u00f6r\u00fcyor, sonra gizli bilgiyi build s\u0131ras\u0131nda<\/strong> (BuildKit secret mount) ve \u00e7al\u0131\u015fma s\u0131ras\u0131nda<\/strong> (Compose secrets) g\u00fcvenle nas\u0131l kullanaca\u011f\u0131n\u0131z\u0131 \u00f6\u011freniyoruz.<\/p>\n

Neden ARG<\/code> ve ENV<\/code> g\u00fcvenli de\u011fil?<\/h2>\n

Docker dok\u00fcmantasyonu bunu a\u00e7\u0131k\u00e7a belirtir: build arg\u00fcmanlar\u0131 ve ortam de\u011fi\u015fkenleri, nihai imajda kal\u0131c\u0131 olarak sakland\u0131klar\u0131 i\u00e7in gizli bilgi aktarmaya uygun de\u011fildir. Bunu do\u011frulamak i\u00e7in \u015fu Dockerfile’\u0131 build ettik:<\/p>\n

FROM temel-imaj\nARG API_TOKEN\nENV TOKEN_ENV=$API_TOKEN\nRUN echo \"kuruldu\"\n\n$ docker build --build-arg API_TOKEN=s3cr3t-token-123 -t sec:bad .<\/code><\/pre>\n
\u0130maj\u0131 inceleyen herkes \u2014 imaj\u0131 \u00e7ekebilen herkes \u2014 token’\u0131 g\u00f6rebilir:<\/p>\n
$ docker history --no-trunc sec:bad --format '{{.CreatedBy}}' | grep TOKEN\nRUN |1 API_TOKEN=s3cr3t-token-123 \/bin\/sh -c echo \"kuruldu\" # buildkit\nENV TOKEN_ENV=s3cr3t-token-123\nARG API_TOKEN=s3cr3t-token-123\n\n$ docker inspect sec:bad --format '{{.Config.Env}}'\n[PATH=... TOKEN_ENV=s3cr3t-token-123]<\/code><\/pre>\n
Token hem katman ge\u00e7mi\u015finde hem de imaj\u0131n yap\u0131land\u0131rmas\u0131nda duruyor. \u0130maj\u0131 ENV<\/code> olmadan, yaln\u0131zca ARG<\/code> ile build etseniz bile de\u011fer katman ge\u00e7mi\u015finde kal\u0131r. Modern Docker bunu build s\u0131ras\u0131nda da uyar\u0131r:<\/p>\n
WARN: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions\nfor sensitive data (ARG \"API_TOKEN\") (line 2)<\/code><\/pre>\n
Build s\u0131ras\u0131nda: BuildKit secret mount<\/h2>\n
\u00c7\u00f6z\u00fcm, s\u0131rr\u0131 imaja hi\u00e7 yazmadan<\/em>, yaln\u0131zca ihtiya\u00e7 duyan RUN<\/code> komutuna ge\u00e7ici olarak ba\u011flamakt\u0131r:<\/p>\n
FROM temel-imaj\nRUN --mount=type=secret,id=api_token \\\n    TOKEN=$(cat \/run\/secrets\/api_token) && ozel-paketi-indir \"$TOKEN\"<\/code><\/pre>\n
# Dosyadan\ndocker build --secret id=api_token,src=token.txt .\n\n# Ortam de\u011fi\u015fkeninden\ndocker build --secret id=api_token,env=API_TOKEN .<\/code><\/pre>\n
S\u0131r varsay\u0131lan olarak \/run\/secrets\/<id><\/code> yoluna yaln\u0131zca o RUN<\/code> ad\u0131m\u0131 s\u00fcresince ba\u011flan\u0131r. Ba\u015fka bir hedef yol (target=<\/code>) ya da ortam de\u011fi\u015fkeni olarak (env=<\/code>) ba\u011flamak da m\u00fcmk\u00fcnd\u00fcr:<\/p>\n
RUN --mount=type=secret,id=aws,target=\/root\/.aws\/credentials aws s3 cp ...\nRUN --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID aws s3 cp ...<\/code><\/pre>\n
Do\u011frulama denemesinde 16 karakterlik bir token’\u0131 bu y\u00f6ntemle okuttuk ve ad\u0131m\u0131n \u00e7\u0131kt\u0131s\u0131nda yaln\u0131zca uzunlu\u011fu yazd\u0131rd\u0131k. Ard\u0131ndan imaj\u0131n i\u00e7inde ve katman ge\u00e7mi\u015finde token’\u0131 arad\u0131k:<\/p>\n
$ docker run --rm sec:ok ls \/run\/secrets\nls: cannot access '\/run\/secrets': No such file or directory\n\n$ docker history --no-trunc sec:ok | grep -c s3cr3t\n0\n$ docker save sec:ok | tar -xO | grep -c s3cr3t\n0<\/code><\/pre>\n
S\u0131r nihai imajda yok: \/run\/secrets<\/code> dizini mevcut de\u011fil, ge\u00e7mi\u015fte ve kaydedilmi\u015f imaj ar\u015fivinde hi\u00e7 e\u015fle\u015fme bulunmad\u0131. \u00d6zel bir Git deposuna eri\u015fim gibi durumlar i\u00e7in benzer \u015fekilde RUN --mount=type=ssh<\/code> ve docker buildx build --ssh default .<\/code> kullan\u0131labilir.<\/p>\n
\n  !<\/span><\/p>\n
S\u0131rr\u0131 g\u00fcvenle ba\u011flasan\u0131z bile, komutunuzun kendisi s\u0131rr\u0131 bir dosyaya yazarsa, \u00e7\u0131kt\u0131ya basarsa ya da yan etki olarak imaja kaydederse yine s\u0131zar. Secret mount, s\u0131rr\u0131 katmana yaz\u0131lmaktan<\/em> korur, komutun kendi davran\u0131\u015f\u0131ndan de\u011fil.<\/p>\n<\/div>\n
\u00c7al\u0131\u015fma s\u0131ras\u0131nda: Compose secrets<\/h2>\n
\u00c7al\u0131\u015fan container i\u00e7in gizli bilgiler, ortam de\u011fi\u015fkeni yerine bir dosya olarak ba\u011flanmal\u0131d\u0131r. Compose’ta secrets<\/code> b\u00f6l\u00fcm\u00fc bunu yapar; container i\u00e7inde \/run\/secrets\/<ad><\/code> alt\u0131nda salt okunur bir dosya olarak g\u00f6r\u00fcn\u00fcr:<\/p>\n
services:\n  db:\n    image: postgres:18\n    environment:\n      POSTGRES_PASSWORD_FILE: \/run\/secrets\/db_parola\n    secrets:\n      - db_parola\n\nsecrets:\n  db_parola:\n    file: .\/secrets\/db_parola.txt<\/code><\/pre>\n
Bir\u00e7ok resmi imaj (PostgreSQL, MySQL, MariaDB gibi) bu yakla\u015f\u0131m i\u00e7in *_FILE<\/code> ortam de\u011fi\u015fkenlerini destekler: parola de\u011fi\u015fkenin kendisinde de\u011fil, g\u00f6sterdi\u011fi dosyada durur. B\u00f6ylece docker inspect<\/code> \u00e7\u0131kt\u0131s\u0131nda ve s\u00fcre\u00e7 ortam\u0131nda d\u00fcz metin parola g\u00f6r\u00fcnmez.<\/p>\n\n\n\n\n\n\n\n\n
Y\u00f6ntem<\/th>\n\u0130maja s\u0131zar m\u0131?<\/th>\ndocker inspect<\/code>‘te g\u00f6r\u00fcn\u00fcr m\u00fc?<\/th>\n<\/tr>\n<\/thead>\n
ARG<\/code> \/ ENV<\/code> (build)<\/td>\nEvet<\/strong><\/td>\nEvet<\/strong><\/td>\n<\/tr>\n
docker run -e PAROLA=...<\/code><\/td>\nHay\u0131r<\/td>\nEvet<\/strong> (Config.Env<\/code>)<\/td>\n<\/tr>\n
BuildKit secret mount<\/td>\nHay\u0131r<\/td>\nYok (yaln\u0131zca build’de)<\/td>\n<\/tr>\n
Compose secrets (dosya)<\/td>\nHay\u0131r<\/td>\nHay\u0131r \u2014 dosya olarak ba\u011flan\u0131r<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\u00dcretim i\u00e7in notlar<\/h2>\n