Encrypting the Portainer database
Portainer uses a BoltDB database to store the configuration, kept in the
portainer_datavolume created during installation. This database can be encrypted for additional security through the use of a secret provided when the Portainer Server is started. Encryption can be added during the initial installation or at a later date.
To enable encryption on Docker Standalone, you will first need to create a secret key, then modify your docker run command to mount the secret in the container.
Create a text file on the system running Docker Standalone that is accessible to the Docker executable, yet somewhere secure. For this example, we'll assume the file is called
/root/secrets/portainer_key. In this file enter a secret. This will be the key used to encrypt the Portainer database.
If Portainer is already running, you will need to stop and remove the Portainer container before continuing:
docker stop portainer
docker rm portainer
To encrypt the database, add a bind mount to the
docker runcommand that mounts your secret in
docker runcommand may look like this:
docker run -d -p 8000:8000 -p 9443:9443 --name portainer \
-v /var/run/docker.sock:/var/run/docker.sock \
-v portainer_data:/data \
-v /root/secrets/portainer_key:/run/secrets/portainer \
When the Portainer container starts, it will encrypt any existing database, or for a fresh install will create a new encrypted database as part of the install process.
To enable encryption on Docker Swarm, you will first need to create a secret. You will then either update the service to incorporate the new secret (if you have an existing Portainer installation) or edit the compose file used to create the stack to include the secret (if this is a fresh installation of Portainer).
On a manager node, you can run the following command to create a secret:
echo "This is a secret" | docker secret create portainer_key -
This is a secretwith your secret. This will create a secret named
portainer_key, which will be the key used to encrypt the Portainer database.
To add encryption to an existing Portainer deployment on Docker Swarm, you can use the following command on a manager node:
docker service update \
--secret-add src=portainer_key,target="/run/secrets/portainer" \
The service will add the new secret and encrypt the database.
To install Portainer on Docker Swarm with encryption, you will need to edit the compose file you downloaded as part of the installation process. Add a secrets section to the
This tells the service to use the
portainer_keysecret created earlier. With the secret added, your full
portainerservice definition may look like this:
command: -H tcp://tasks.agent:9001 --tlsskipverify
constraints: [node.role == manager]
Save your changes, then use the compose file to deploy your Portainer installation as covered in the Swarm installation instructions. The database will be deployed encrypted as part of the installation process.
To enable encryption on Kubernetes you will first need to create a secret. You will then mount this secret as a volume in Portainer.
From the command line on your Kubernetes cluster, you can run the following command to create your secret:
kubectl create secret generic portainer-key --from-literal=secret=IAmASecretKey
IAmASecretKeywith your secret. This will create a secret named
portainer-key, which will be the key used to encrypt the Portainer database.
Once the secret has been created, we need to modify the YAML file to mount the secret as a volume in Portainer. Download the YAML file for your particular deployment and locate the
containerdefinition for the
portainercontainer. It should look something like this:
- name: portainer
- name: data
volumeMountssection, add a definition for the secret created earlier:
- name: data
- name: portainer-key
We also need to add a definition to the
volumesdefinition for the
- name: portainer-key
Save the file, then apply it to your running configuration:
kubectl apply -f portainer.yaml
portainer.yamlwith the name of your modified YAML file.