run_docker: mounts /srv/secret