We created a tool to address the challenge of bringing secrets safely into containers: Reflex Engine. This is different from the other solutions, is specifically designed for docker ephemeral containers, uses ABAC for security at the row level, and handles a wide variety of configuration needs (java/xml, json, environ, etc). We are currently using it with Docker Cloud. Feedback welcome!