Why do I need to be in Swarm mode to use Docker secrets?

You need to run swarm mode for secrets because that's how docker implemented secrets. The value of secrets is that workers never write the secret to disk, the secret is on a need-to-know basis (other workers do not receive the secret until a task is scheduled there), and on managers encrypt that secret on disk. The storage of the secret on the manager uses the raft database.

You can easily deploy a single node swarm cluster with the command docker swarm init. From there, docker-compose up gets changed to docker stack deploy -c docker-compose.yml $stack_name.

Secrets and configs in swarm mode provide a replacement for mounting single file volumes into containers for configuration. So without swarm mode on a single node, you can always make the following definition:

version: '2'services:  app:    image: myapp:latest    volumes:    - ./secrets:/run/secrets:ro

Or you can separate the secrets from your app slightly by loading those secrets into a named volume. For that, you could do something like:

tar -cC ./secrets . | docker run -i -v secrets:/secrets busybox tar -xC /secrets

And then mount that named volume:

version: '2'volumes:  secrets:    external: trueservices:  app:    image: myapp:latest    volumes:    - secrets:/run/secrets:ro

Check out this answer: https://serverfault.com/a/936262 as provided by user sel-en-ium :-

You can use secrets if you use a compose file. (You don't need to run a swarm).

You use a compose file with docker-compose: there is documentation for "secrets" in a docker-compose.yml file.

I switched to docker-compose because I wanted to use secrets. I am happy I did, it seems much more clean. Each service maps to a container. And if you ever want to switch to running a swarm instead, you are basically already there.

Unfortunately the secrets are not loaded into the container's environment, they are mounted to /run/secrets/