How are other folks handling sensitive data in Docker container logs?
For example, if someone connects to a container and shows credentials or pulls up some user data (legitimate or otherwise).
Are you just scrubbing your logs thoroughly before indexing, or doing something to avoid the data hitting the logs at all?
@signaleleven sorry, not sure why I just got your notification.
By default, Docker logs everything sent to STDOUT, STDIN, or STDERR. So if someone say, cats a private key file, or echos a sensitive environment variable while connected to a container, that's now in the logs.
My question isn't whether sensitive data should be logged, it's how are others handling this specific case? Are you scrubbing your logs of this data? Using an alternative log driver? Something else entirely?
@jamesiarmes it's not just docker that logs stdout/stderr. Many init systems do.
To me printing and logging are the same thing, so it's up to the program to avoid logging secrets. Scrubbing is a losing battle.
That being said, if you exec into a running container (open a shell) your actions and their output are not logged. Only stdout/stderr of the container command are logged so you have less to worry about 😊
Your question was very clear, my bad.
James Armes 
🍉
SignalEleven