version: '3.1'

services:
  a:
    image: tutum/hello-world
  secret:
    password: the_password
  b:
    image: tutum/hello-world

$ docker swarm init

$ echo "This is an external secret" | docker secret create my_external_secret -

$ echo "This is a file secret." > my_file_secret.txt

version: '3.1'

services:
  web:
    image: nginxdemos/hello
    secrets:                    # secrets block only for 'web' service
     - my_external_secret
     - my_file_secret

secrets:                        # top level secrets block
  my_external_secret:
    external: true
  my_file_secret:
    file: my_file_secret.txt

$ docker stack deploy --compose-file=docker-compose.yml secret_test

$ docker exec -ti secret_test_web.1.m2jgacogzsiaqhgq1z0yrwekd /bin/sh

# Now inside secret_test_web; secrets are contained in /run/secrets/
root@secret_test_web:~$ cd /run/secrets/

root@secret_test_web:/run/secrets$ ls
my_external_secret  my_file_secret

root@secret_test_web:/run/secrets$ cat my_external_secret
This is an external secret

root@secret_test_web:/run/secrets$ cat my_file_secret
This is a file secret.

version: '3.1'

services:
  myapp:
    build: .
    secrets:
      secrets_yaml

docker secret create secrets_yaml secrets.yml

docker deploy --compose-file docker-compose.yml myappstack

# create a temporary secret file
cat secrets.yml | vault write secret/myappsecrets -

vault read -field=value secret/myappsecrets | docker secret create secrets_yaml -

version: '3.1'

secrets:
  password:
    file: ./password

services:
  password_consumer:
    image: alpine
    secrets:
      - password