# Docker Setup with Vault Encryption key, "token are too open"

**URL:** <https://forums.percona.com/t/docker-setup-with-vault-encryption-key-token-are-too-open/39199>\
**Category:** Percona Server for MongoDB\
**Created:** [August 25, 2025, 12:35pm UTC](https://forums.percona.com/t/docker-setup-with-vault-encryption-key-token-are-too-open/39199 "2025-08-25T12:35:37Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![radoslaw.szulgo](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/radoslaw.szulgo/32/17315_2.png) [@radoslaw.szulgo](https://forums.percona.com/u/radoslaw.szulgo)\
**Post date:** [September 10, 2025, 6:56pm UTC](https://forums.percona.com/t/docker-setup-with-vault-encryption-key-token-are-too-open/39199/2 "2025-09-10T18:56:08Z")

</div>

Hi @MohamedAziz

Thanks for the question and congrats on your first post - welcome to the Percona Community!

You’re fighting against the designed behavior of Docker Secrets. Docker mounts secrets as read-only files with `0444` (`-r--r--r--`) permissions owned by `root`. You cannot change this directly. The MongoDB process, for security reasons, refuses to use a token file that is world-readable.

The solution is to **create an entrypoint script** that copies the secret to a new location, sets the correct permissions and ownership on the copy, and then starts MongoDB pointing to that new file.

Here’s a sample script that may help:

```auto
#!/bin/bash
set -e 
VAULT_TOKEN_SECRET_FILE="/run/secrets/token"
MONGOD_VAULT_TOKEN_FILE="/etc/mongodb-key/vault-token" # A new location

if [-f "$VAULT_TOKEN_SECRET_FILE"]; then
    cp "$VAULT_TOKEN_SECRET_FILE" "$MONGOD_VAULT_TOKEN_FILE"
    chown mongodb:mongodb "$MONGOD_VAULT_TOKEN_FILE"
    chmod 400 "$MONGOD_VAULT_TOKEN_FILE"
fi

exec "$@"

```

Then add to your Dockerfile:

```auto
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]

```

and in your mongod.conf:

```auto
security:
  enableEncryption: true
  vault:
    serverName: <your-vault-server-ip>
    port: 8200
    tokenFile: /etc/mongodb-key/vault-token
    secret: <path-to-your-secret-in-vault>

```

Hope this helps!

---

_[View the full topic](https://forums.percona.com/t/docker-setup-with-vault-encryption-key-token-are-too-open/39199)._