# docker\_secret module does not behave the same as docker recommended approach

**URL:** <https://forum.ansible.com/t/docker-secret-module-does-not-behave-the-same-as-docker-recommended-approach/32436>\
**Category:** Ansible Project\
**Created:** [March 10, 2020, 7:09pm UTC](https://forum.ansible.com/t/docker-secret-module-does-not-behave-the-same-as-docker-recommended-approach/32436 "2020-03-10T19:09:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Matthew\_Wimpelberg](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@Matthew\_Wimpelberg](https://forum.ansible.com/u/Matthew_Wimpelberg)\
**Post date:** [March 10, 2020, 7:09pm UTC](https://forum.ansible.com/t/docker-secret-module-does-not-behave-the-same-as-docker-recommended-approach/32436/1 "2020-03-10T19:09:25Z")

</div>

I recently moved my Docker Swarm setup to Ansible and found an issue with the docker\_secret module. In each container my code runs cat /run/secrets/\* \> all\_secrets to concatenate all of the secrets into a file where each line is a secret. Previous to Ansible, we echoed the secret and piped it to docker secret create as per their recommendation ([https://docs.docker.com/engine/reference/commandline/secret\_create/](https://docs.docker.com/engine/reference/commandline/secret_create/)). Once we moved the secrets to a variable file for Ansible we found that the secrets are concatenated on one line which causes issues when the file is parsed. When I add a carriage return in the variables file it mimics the behavior of echoing the secret to | docker secret.

This example is with echo

`  
[root@master ~]# echo ‘security\_key=12345’ | docker secret create security\_key -  
kibapcvv97qbayyusverfx8rp  
[root@master ~]# echo ‘security\_password=abcdef’ | docker secret create security\_password -  
0cf3ryjijlf496samric8dg2f  
[root@master ~]# docker service create --name myservice --secret security\_key --secret security\_password redis:alpine  
ps73gnormz40zmmrmbqca1lxc  
overall progress: 1 out of 1 tasks  
1/1: running  
verify: Service converged

[root@master ~]# docker ps  
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES  
f70bdb910cbe redis:alpine “docker-entrypoint.s…” 41 seconds ago Up 41 seconds 6379/tcp myservice.1.hzgkm48hjhwl1u6u0m7hif6f2  
[root@master ~]# docker exec -it f70bdb910cbe /bin/sh  
/data # cat /run/secrets/security\_\* \> /run/secrets/all\_secrets  
/data # cat /run/secrets/all\_secrets  
security\_key=12345  
security\_password=abcdef  
`

This example is with Ansible with no carriage return

`  
[root@master ~]# cat playbook.yml

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [March 11, 2020, 10:10am UTC](https://forum.ansible.com/t/docker-secret-module-does-not-behave-the-same-as-docker-recommended-approach/32436/2 "2020-03-11T10:10:36Z")

</div>

Hi,

> [root@master ~]# echo 'security\_key=12345' | docker secret create  
> security\_key -

Here, you are piping the string \*and a newline\* into `docker secret  
create`. echo always outputs a newline (except if you call it with -n).

So you also need to add a newline in Ansible if you want the newline to  
be in there.

It might be easier to insert the newline here though:

> &nbsp;&nbsp;&nbsp;&nbsp;- name: copy secrets  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;docker\_secret:  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;name: "{{ item.name }}"  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;data: "{{ item.value }}"  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;state: present

This should probably do the trick:

> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;data: "{{ item.value }}\n"

Cheers,  
Felix