secrets ideas

docs/secrets.md

@@ -0,0 +1,21 @@
+# Ideas about secret management
+
+It's a bad idea to store secrets in a docker image.
+
+However, code running in docker containers like a funko does often needs
+access to secrets, such as passwords to databases. Let's use that as the
+example secret for the rest of the document.
+
+Also, not all funkos should have access to all the secrets, and the 
+"need to know" should be declarative in the funko's metadata.
+
+## Problem 1: accessing secrets in the proxy container from the funkos 
+
+Let's further assume that faaso-proxy has access *somehow* to all the secrets,
+identified by a name. So there is a "dbpass" secret that has "verysecret" as
+it's very secret content.
+
+Also let's assume the proxy has access to a folder in the server filesystem,
+`/secrets` via something like a bind mount.
+
+## Problem 2: how can the proxy know the secrets without keeping them in the image?