# Docker and Ansible Vault: An insecure match?

**URL:** <https://forum.ansible.com/t/docker-and-ansible-vault-an-insecure-match/18751>\
**Category:** Ansible Project\
**Created:** [July 14, 2015, 1:06am UTC](https://forum.ansible.com/t/docker-and-ansible-vault-an-insecure-match/18751 "2015-07-14T01:06:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mahmoud\_Saada](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Mahmoud\_Saada](https://forum.ansible.com/u/Mahmoud_Saada)\
**Post date:** [July 14, 2015, 1:06am UTC](https://forum.ansible.com/t/docker-and-ansible-vault-an-insecure-match/18751/1 "2015-07-14T01:06:46Z")

</div>

Ansible Vault requires to prompt the user for a password or a file containing the password. But if I’m running Ansible inside of a [container](https://registry.hub.docker.com/u/ansible/ubuntu14.04-ansible/), I cannot prompt the user for a password.

How can I run a playbook using vars encrypted by Vault during a Docker build?  
How can I do it without exposing a password file?  
Is there a best practice?

---

<div class="post-metadata">

**Author:** ![Paul\_Totterman](https://avatars.discourse-cdn.com/v4/letter/p/3ec8ea/32.png) [@Paul\_Totterman](https://forum.ansible.com/u/Paul_Totterman)\
**Post date:** [July 15, 2015, 7:55am UTC](https://forum.ansible.com/t/docker-and-ansible-vault-an-insecure-match/18751/2 "2015-07-15T07:55:57Z")

</div>

> How can I run a playbook using vars encrypted by Vault during a Docker build?

Don’t

> How can I do it without exposing a password file?  
> Is there a best practice?

Give sensitive information to the docker container as environment values. See e.g. [https://registry.hub.docker.com/\_/postgres/](https://registry.hub.docker.com/_/postgres/) and POSTGRES\_PASSWORD

Cheers,  
Paul