[bigmac]

Great points, we're working on a bunch of this stuff.

Docker 1.12 in swarm mode, for example, does automatic key rotation and issuance of the TLS certs assigned to every node in the cluster. These certs are used for automatic TLS between every node in the control plane of the Docker Swarm. This is all automatic and transparent to the user -- no manual management of certificates is required.

Now that we have cryptographic identities assigned to every node in the cluster we can use that to build secrets/key management in to the system.

Additionally Docker 1.12 is swarm mode has overlay networking with encryption possible for container to container communications.

In terms of logs, Docker supports log drivers that allow all logs within Docker containers to be exported to off-host logging services.

[rmoriz]

How is the overlay network encrypted? I couldn't find any information. https://github.com/docker/docker/issues/24253 says it's not encrypted by default and must be enabled manually.

[bigmac]

You're right -- it needs to be enabled manually using `--opt encrypted`. 1.13 is shooting for this to be the default.