How do I securely add an api key to a dockerized Shiny App?

Question

I have an R shiny app, and I want to deploy it in a docker container.

At the moment, the Shiny app retrieves an api_key from my environment, and uses it to retrieve data.

In order to make this api_key available to Shiny within the container, it looks like I have to save it within /home/shiny/.Renviron. This means that people who receive the container can explore the filesystem and find the api_key.

I'm wondering if there's any way around this; is there any way to make the api_key available to the shiny app, but not to people who receive the container image?

Answer 1

Configure environment variable for the container:

docker run -d \
  -e API_KEY=<api-key> \
  ...
  shiny-app-image

And use it in R:

Sys.getenv("API_KEY")

So variable API_KEY will be defined on the container level, not in the Docker image.