Put Secrets in Environment Variables#
Secrets like Django’s SECRET_KEY
don’t belong in a container image or a public repository. They need to be handled in a way that protects them from being revealed. With containers, the most common way to do that is to put secrets in environment variables. This lab will show you how to use an environment variable in Python.
Edit Django’s Configuration#
Django’s configuration is Python where using environment variables isn’t quite as easy as with the shell. Edit your mysite/settings.py
file and add the following line to the top near the other import
statements:
import os
Now find the line that looks like this:
SECRET_KEY = 'django-insecure-@o71s+_^+tm0*33j7gv3xrjjtue5)z55sjg40urg(7pu*8kl)5'
And change it to this:
SECRET_KEY = os.environ['SECRET_KEY']
If you try to start Django now you should see an error:
$ python3 ./manage.py runserver
python3 ./manage.py runserver
Traceback (most recent call last):
File "/home/maximus/lifealgorithmic-web/work/cis-92/django/mysite/./manage.py", line 22, in <module>
main()
File "/home/maximus/lifealgorithmic-web/work/cis-92/django/mysite/./manage.py", line 18, in main
execute_from_command_line(sys.argv)
File "/home/maximus/.local/lib/python3.10/site-packages/django/core/management/__init__.py", line 446, in execute_from_command_line
utility.execute()
File "/home/maximus/.local/lib/python3.10/site-packages/django/core/management/__init__.py", line 386, in execute
settings.INSTALLED_APPS
File "/home/maximus/.local/lib/python3.10/site-packages/django/conf/__init__.py", line 92, in __getattr__
self._setup(name)
File "/home/maximus/.local/lib/python3.10/site-packages/django/conf/__init__.py", line 79, in _setup
self._wrapped = Settings(settings_module)
File "/home/maximus/.local/lib/python3.10/site-packages/django/conf/__init__.py", line 190, in __init__
mod = importlib.import_module(self.SETTINGS_MODULE)
File "/usr/lib/python3.10/importlib/__init__.py", line 126, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
File "<frozen importlib._bootstrap>", line 1050, in _gcd_import
File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
File "<frozen importlib._bootstrap_external>", line 883, in exec_module
File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed
File "/home/maximus/lifealgorithmic-web/work/cis-92/django/mysite/mysite/settings.py", line 24, in <module>
SECRET_KEY = os.environ['SECRET_KEY']
File "/usr/lib/python3.10/os.py", line 679, in __getitem__
raise KeyError(key) from None
KeyError: 'SECRET_KEY'
Set an Environment Variable in Docker#
You should already know how to set an environment variable in the shell. But local variables don’t affect docker containers. Rebuild your container on your dev box with the new code:
$ docker build -t mysite .
Now run the new container and set an environment variable:
$ docker run -it --rm -e SECRET_KEY=django-super-secret-key -p 8080:8000 mysite