Best practices for managing secrets with Arcane

[llaumgui]

Hi,

I recently migrated from Portainer to Arcane, and I have to say the tool is really great 👍
I’ve even connected agents on my other servers, which gives me a single, unified interface across all my infrastructure.

Now I’m starting to think about secrets management.

So far, I’m still using .env files, but that means secrets are stored in clear text, which is not ideal.
Before going further, I’d like to understand what the recommended best practices with Arcane are regarding secrets:

Is there a native way to manage secrets securely in Arcane?

Is it expected to rely on external tools (e.g. Docker secrets, SOPS, Vault, etc.)?

Are there any plans or guidelines documented somewhere for secret management?

In short: what is the “Arcane way” to avoid keeping secrets in plain text .env files?

Thanks in advance for your guidance, and congrats again on the project 🚀

[kuya1284]

I use the Docker Secrets implementation. Just add the __FILE suffix to the end of your environment variable and store your secrets in a file on the filesystem in a secure location (i.e. /opt/secrets/app/db-password).

This is what I do for all my containers that require a password/key/token.

[llaumgui]

Good solution for container that support the _FILE suffix... But not a global solution.

[kuya1284]

Sorry, I thought you were asking specifically about Arcane. I'm now realizing that you were referring to all projects/containers managed via Arcane.