Repository navigation
Releases: docker/secrets-engine
Release list
Secrets Engine v0.11.1
Linux (experimental)
Packages
Secrets Engine — the standalone engine binary
Recommended:
dbus— required for the keyring backends.gnome-keyringorkwallet— secret storage backend.
Configuration package — wires the engine into your Docker setup:
configures dockerd and makes docker pass available as a subcommand of the
Docker CLI.
Requirements:
- Secrets Engine standalone
- Docker Engine
>= 29.2.0— eitherdocker-ce(from Docker's apt repo) or
docker.io(from your distribution).
Standalone binary
Linux (amd64 shown; substitute arm64 on ARM machines):
BASE="https://github.com/docker/secrets-engine/releases/download/v0.11.1"
curl -fsSLO "${BASE}/secrets-engine-linux_amd64.tar.gz"
curl -fsSLO "${BASE}/secrets-engine-linux_amd64.sha256"
curl -fsSLO "${BASE}/secrets-engine-linux_amd64.sigstore.json"
tar xzf secrets-engine-linux_amd64.tar.gz
sha256sum --check secrets-engine-linux_amd64.sha256
cosign verify-blob secrets-engine \
--bundle secrets-engine-linux_amd64.sigstore.json \
--certificate-identity "https://github.com/docker/secrets-engine/.github/workflows/sign-release.yml@refs/tags/v0.11.1" \
--certificate-oidc-issuer https://token.actions.githubusercontent.comManual install
1. Secrets engine multipurpose binary
sudo install -D -m 0755 secrets-engine /usr/bin/docker-secrets-engine
# Optional: adds docker-pass to $PATH
sudo ln -sf docker-secrets-engine /usr/bin/docker-pass
sudo install -d -m 0755 /usr/libexec/docker-secrets-engine/pluginsThe plugin directory must stay root-owned and world-readable only.
2. systemd user unit.
sudo tee /usr/lib/systemd/user/docker-secrets-engine.service >/dev/null <<'EOF'
[Unit]
Description=Docker secrets engine daemon
Documentation=https://docs.docker.com/
[Service]
Type=simple
ExecStart=/usr/bin/docker-secrets-engine
CacheDirectory=docker-secrets-engine
CacheDirectoryMode=0700
Restart=on-failure
RestartSec=2s
# Ensure a crash never leaves a core dump on disk for a same-UID peer to read.
LimitCORE=0
[Install]
WantedBy=default.target
EOF
systemctl --user daemon-reload
systemctl --user enable --now docker-secrets-engine3. Configuring docker integration (optional)
Requires Docker Engine >= 29.2.0.
# 1. Create the plugin and config directories
sudo install -d -m 0755 \
/usr/libexec/docker/cli-plugins \
/usr/libexec/docker/nri-plugins \
/var/log/docker-secrets-engine-plugins \
/etc/docker/nri/conf.d
# 2. Link the binary into each plugin location
sudo ln -sf /usr/bin/docker-secrets-engine /usr/libexec/docker/cli-plugins/docker-pass
sudo ln -sf /usr/bin/docker-secrets-engine /usr/libexec/docker/nri-plugins/10-secrets-engine
# 3. Configure the NRI plugin to run as your user
echo "uid: $(id -u)" | sudo tee /etc/docker/nri/conf.d/10-secrets-engine.conf > /dev/null
# 4. Enable NRI in the Docker daemon config
sudo touch /etc/docker/daemon.json
docker-secrets-engine setup nri-config enable \
< /etc/docker/daemon.json > /tmp/daemon.json \
&& sudo install -m 0644 /tmp/daemon.json /etc/docker/daemon.json
# 5. Restart Docker
sudo systemctl restart dockerThe uid: line tells the root-run NRI plugin which user's daemon to target;
skip it for rootless dockerd. docker-secrets-engine setup nri-config enable
merges {"nri-opts": {"enable": true}} into daemon.json and keeps your
other keys.
Uninstall
# 1. Remove the Docker integration (skip if you did not configure it)
docker-secrets-engine setup nri-config disable \
< /etc/docker/daemon.json > /tmp/daemon.json \
&& sudo install -m 0644 /tmp/daemon.json /etc/docker/daemon.json
sudo rm -f \
/usr/libexec/docker/cli-plugins/docker-pass \
/usr/libexec/docker/nri-plugins/10-secrets-engine \
/etc/docker/nri/conf.d/10-secrets-engine.conf
sudo rm -rf /var/log/docker-secrets-engine-plugins
sudo systemctl restart docker
# 2. Stop and remove the systemd user unit
systemctl --user disable --now docker-secrets-engine
sudo rm -f /usr/lib/systemd/user/docker-secrets-engine.service
systemctl --user daemon-reload
# 3. Remove the binary and its plugin directory
sudo rm -f /usr/bin/docker-secrets-engine /usr/bin/docker-pass
sudo rm -rf /usr/libexec/docker-secrets-engineDirectories shared with Docker stay in place.
This release was build from
github.com/docker/secrets-engine/client@v0.2.2github.com/docker/secrets-engine/plugin@v0.3.4github.com/docker/secrets-engine/plugins/pass@v0.4.3github.com/docker/secrets-engine/store@v0.4.3github.com/docker/secrets-engine/x@v0.8.5
Secrets Engine v0.11.0
Linux (experimental)
Packages
Secrets Engine — the standalone engine binary
Recommended:
dbus— required for the keyring backends.gnome-keyringorkwallet— secret storage backend.
Configuration package — wires the engine into your Docker setup:
configures dockerd and makes docker pass available as a subcommand of the
Docker CLI.
Requirements:
- Secrets Engine standalone
- Docker Engine
>= 29.2.0— eitherdocker-ce(from Docker's apt repo) or
docker.io(from your distribution).
Standalone binary
Linux (amd64 shown; substitute arm64 on ARM machines):
BASE="https://github.com/docker/secrets-engine/releases/download/v0.11.0"
curl -fsSLO "${BASE}/secrets-engine-linux_amd64.tar.gz"
curl -fsSLO "${BASE}/secrets-engine-linux_amd64.sha256"
curl -fsSLO "${BASE}/secrets-engine-linux_amd64.sigstore.json"
tar xzf secrets-engine-linux_amd64.tar.gz
sha256sum --check secrets-engine-linux_amd64.sha256
cosign verify-blob secrets-engine \
--bundle secrets-engine-linux_amd64.sigstore.json \
--certificate-identity "https://github.com/docker/secrets-engine/.github/workflows/sign-release.yml@refs/tags/v0.11.0" \
--certificate-oidc-issuer https://token.actions.githubusercontent.comManual install
1. Secrets engine multipurpose binary
sudo install -D -m 0755 secrets-engine /usr/bin/docker-secrets-engine
# Optional: adds docker-pass to $PATH
sudo ln -sf docker-secrets-engine /usr/bin/docker-pass
sudo install -d -m 0755 /usr/libexec/docker-secrets-engine/pluginsThe plugin directory must stay root-owned and world-readable only.
2. systemd user unit.
sudo tee /usr/lib/systemd/user/docker-secrets-engine.service >/dev/null <<'EOF'
[Unit]
Description=Docker secrets engine daemon
Documentation=https://docs.docker.com/
[Service]
Type=simple
ExecStart=/usr/bin/docker-secrets-engine
CacheDirectory=docker-secrets-engine
CacheDirectoryMode=0700
Restart=on-failure
RestartSec=2s
# Ensure a crash never leaves a core dump on disk for a same-UID peer to read.
LimitCORE=0
[Install]
WantedBy=default.target
EOF
systemctl --user daemon-reload
systemctl --user enable --now docker-secrets-engine3. Configuring docker integration (optional)
Requires Docker Engine >= 29.2.0.
# 1. Create the plugin and config directories
sudo install -d -m 0755 \
/usr/libexec/docker/cli-plugins \
/usr/libexec/docker/nri-plugins \
/var/log/docker-secrets-engine-plugins \
/etc/docker/nri/conf.d
# 2. Link the binary into each plugin location
sudo ln -sf /usr/bin/docker-secrets-engine /usr/libexec/docker/cli-plugins/docker-pass
sudo ln -sf /usr/bin/docker-secrets-engine /usr/libexec/docker/nri-plugins/10-secrets-engine
# 3. Configure the NRI plugin to run as your user
echo "uid: $(id -u)" | sudo tee /etc/docker/nri/conf.d/10-secrets-engine.conf > /dev/null
# 4. Enable NRI in the Docker daemon config
sudo touch /etc/docker/daemon.json
docker-secrets-engine setup nri-config enable \
< /etc/docker/daemon.json > /tmp/daemon.json \
&& sudo install -m 0644 /tmp/daemon.json /etc/docker/daemon.json
# 5. Restart Docker
sudo systemctl restart dockerThe uid: line tells the root-run NRI plugin which user's daemon to target;
skip it for rootless dockerd. docker-secrets-engine setup nri-config enable
merges {"nri-opts": {"enable": true}} into daemon.json and keeps your
other keys.
Uninstall
# 1. Remove the Docker integration (skip if you did not configure it)
docker-secrets-engine setup nri-config disable \
< /etc/docker/daemon.json > /tmp/daemon.json \
&& sudo install -m 0644 /tmp/daemon.json /etc/docker/daemon.json
sudo rm -f \
/usr/libexec/docker/cli-plugins/docker-pass \
/usr/libexec/docker/nri-plugins/10-secrets-engine \
/etc/docker/nri/conf.d/10-secrets-engine.conf
sudo rm -rf /var/log/docker-secrets-engine-plugins
sudo systemctl restart docker
# 2. Stop and remove the systemd user unit
systemctl --user disable --now docker-secrets-engine
sudo rm -f /usr/lib/systemd/user/docker-secrets-engine.service
systemctl --user daemon-reload
# 3. Remove the binary and its plugin directory
sudo rm -f /usr/bin/docker-secrets-engine /usr/bin/docker-pass
sudo rm -rf /usr/libexec/docker-secrets-engineDirectories shared with Docker stay in place.
This release was build from
github.com/docker/secrets-engine/client@v0.2.0github.com/docker/secrets-engine/plugin@v0.3.2github.com/docker/secrets-engine/plugins/pass@v0.4.0github.com/docker/secrets-engine/store@v0.4.1github.com/docker/secrets-engine/x@v0.8.3
Secrets Engine v0.10.0
Linux (experimental)
Packages
Secrets Engine — the standalone engine binary
Recommended:
dbus— required for the keyring backends.gnome-keyringorkwallet— secret storage backend.
Configuration package — wires the engine into your Docker setup:
configures dockerd and makes docker pass available as a subcommand of the
Docker CLI.
Requirements:
- Secrets Engine standalone
- Docker Engine
>= 29.2.0— eitherdocker-ce(from Docker's apt repo) or
docker.io(from your distribution).
Standalone binary
Linux (amd64 shown; substitute arm64 on ARM machines):
BASE="https://github.com/docker/secrets-engine/releases/download/v0.10.0"
curl -fsSLO "${BASE}/secrets-engine-linux_amd64.tar.gz"
curl -fsSLO "${BASE}/secrets-engine-linux_amd64.sha256"
curl -fsSLO "${BASE}/secrets-engine-linux_amd64.sigstore.json"
tar xzf secrets-engine-linux_amd64.tar.gz
sha256sum --check secrets-engine-linux_amd64.sha256
cosign verify-blob secrets-engine \
--bundle secrets-engine-linux_amd64.sigstore.json \
--certificate-identity "https://github.com/docker/secrets-engine/.github/workflows/sign-release.yml@refs/tags/v0.10.0" \
--certificate-oidc-issuer https://token.actions.githubusercontent.comManual install
1. Secrets engine multipurpose binary
sudo install -D -m 0755 secrets-engine /usr/bin/docker-secrets-engine
# Optional: adds docker-pass to $PATH
sudo ln -sf docker-secrets-engine /usr/bin/docker-pass
sudo install -d -m 0755 /usr/libexec/docker-secrets-engine/pluginsThe plugin directory must stay root-owned and world-readable only.
2. systemd user unit.
sudo tee /usr/lib/systemd/user/docker-secrets-engine.service >/dev/null <<'EOF'
[Unit]
Description=Docker secrets engine daemon
Documentation=https://docs.docker.com/
[Service]
Type=simple
ExecStart=/usr/bin/docker-secrets-engine
CacheDirectory=docker-secrets-engine
CacheDirectoryMode=0700
Restart=on-failure
RestartSec=2s
# Ensure a crash never leaves a core dump on disk for a same-UID peer to read.
LimitCORE=0
[Install]
WantedBy=default.target
EOF
systemctl --user daemon-reload
systemctl --user enable --now docker-secrets-engine3. Configuring docker integration (optional)
Requires Docker Engine >= 29.2.0.
# 1. Create the plugin and config directories
sudo install -d -m 0755 \
/usr/libexec/docker/cli-plugins \
/usr/libexec/docker/nri-plugins \
/var/log/docker-secrets-engine-plugins \
/etc/docker/nri/conf.d
# 2. Link the binary into each plugin location
sudo ln -sf /usr/bin/docker-secrets-engine /usr/libexec/docker/cli-plugins/docker-pass
sudo ln -sf /usr/bin/docker-secrets-engine /usr/libexec/docker/nri-plugins/10-secrets-engine
# 3. Configure the NRI plugin to run as your user
echo "uid: $(id -u)" | sudo tee /etc/docker/nri/conf.d/10-secrets-engine.conf > /dev/null
# 4. Enable NRI in the Docker daemon config
sudo touch /etc/docker/daemon.json
docker-secrets-engine setup nri-config enable \
< /etc/docker/daemon.json > /tmp/daemon.json \
&& sudo install -m 0644 /tmp/daemon.json /etc/docker/daemon.json
# 5. Restart Docker
sudo systemctl restart dockerThe uid: line tells the root-run NRI plugin which user's daemon to target;
skip it for rootless dockerd. docker-secrets-engine setup nri-config enable
merges {"nri-opts": {"enable": true}} into daemon.json and keeps your
other keys.
Uninstall
# 1. Remove the Docker integration (skip if you did not configure it)
docker-secrets-engine setup nri-config disable \
< /etc/docker/daemon.json > /tmp/daemon.json \
&& sudo install -m 0644 /tmp/daemon.json /etc/docker/daemon.json
sudo rm -f \
/usr/libexec/docker/cli-plugins/docker-pass \
/usr/libexec/docker/nri-plugins/10-secrets-engine \
/etc/docker/nri/conf.d/10-secrets-engine.conf
sudo rm -rf /var/log/docker-secrets-engine-plugins
sudo systemctl restart docker
# 2. Stop and remove the systemd user unit
systemctl --user disable --now docker-secrets-engine
sudo rm -f /usr/lib/systemd/user/docker-secrets-engine.service
systemctl --user daemon-reload
# 3. Remove the binary and its plugin directory
sudo rm -f /usr/bin/docker-secrets-engine /usr/bin/docker-pass
sudo rm -rf /usr/libexec/docker-secrets-engineDirectories shared with Docker stay in place.
This release was build from
github.com/docker/secrets-engine/client@v0.1.2github.com/docker/secrets-engine/plugin@v0.3.2github.com/docker/secrets-engine/plugins/pass@v0.3.1github.com/docker/secrets-engine/store@v0.4.1github.com/docker/secrets-engine/x@v0.8.2
Secrets Engine v0.9.0
Linux (experimental)
Packages
Secrets Engine — the standalone engine binary
Recommended:
dbus— required for the keyring backends.gnome-keyringorkwallet— secret storage backend.
Configuration package — wires the engine into your Docker setup:
configures dockerd and makes docker pass available as a subcommand of the
Docker CLI.
Requirements:
- Secrets Engine standalone
- Docker Engine
>= 29.2.0— eitherdocker-ce(from Docker's apt repo) or
docker.io(from your distribution).
This release was build from
github.com/docker/secrets-engine/client@v0.0.29github.com/docker/secrets-engine/plugin@v0.1.0github.com/docker/secrets-engine/plugins/pass@v0.2.0github.com/docker/secrets-engine/store@v0.2.0github.com/docker/secrets-engine/x@v0.1.0-do.not.use
Secrets Engine v0.8.2
Linux (experimental)
Packages
Secrets Engine — the standalone engine binary
Recommended:
dbus— required for the keyring backends.gnome-keyringorkwallet— secret storage backend.
Configuration package — wires the engine into your Docker setup:
configures dockerd and makes docker pass available as a subcommand of the
Docker CLI.
Requirements:
- Secrets Engine standalone
- Docker Engine
>= 29.2.0— eitherdocker-ce(from Docker's apt repo) or
docker.io(from your distribution).
Install
# Replace with the files you downloaded (matching your distro and arch).
sudo apt install ./DockerSecretsEngine-linux-amd64-ubuntu2404.deb \
./DockerSecretsEnginePlugins-linux-ubuntu2404.deb
systemctl --user daemon-reload
systemctl --user enable --now docker-secrets-engine.serviceUninstall
systemctl --user disable --now docker-secrets-engine.service
sudo apt remove docker-secrets-engine-plugins docker-secrets-engineThis release was build from
github.com/docker/secrets-engine/client@v0.0.29github.com/docker/secrets-engine/plugin@v0.1.0github.com/docker/secrets-engine/plugins/pass@v0.2.0github.com/docker/secrets-engine/store@v0.2.0github.com/docker/secrets-engine/x@v0.1.0-do.not.use
Secrets Engine v0.8.1
Linux (experimental)
Packages
Secrets Engine — the standalone engine binary
Recommended:
dbus— required for the keyring backends.gnome-keyringorkwallet— secret storage backend.
Configuration package — wires the engine into your Docker setup:
configures dockerd and makes docker pass available as a subcommand of the
Docker CLI.
Requirements:
- Secrets Engine standalone
- Docker Engine
>= 29.2.0— eitherdocker-ce(from Docker's apt repo) or
docker.io(from your distribution).
Install
# Replace with the files you downloaded (matching your distro and arch).
sudo apt install ./DockerSecretsEngine-linux-amd64-ubuntu2404.deb \
./DockerSecretsEnginePlugins-linux-ubuntu2404.deb
systemctl --user daemon-reload
systemctl --user enable --now docker-secrets-engine.serviceUninstall
systemctl --user disable --now docker-secrets-engine.service
sudo apt remove docker-secrets-engine-plugins docker-secrets-engineThis release was build from
github.com/docker/secrets-engine/client@v0.0.29github.com/docker/secrets-engine/plugin@v0.1.0github.com/docker/secrets-engine/plugins/pass@v0.2.0github.com/docker/secrets-engine/store@v0.2.0github.com/docker/secrets-engine/x@v0.1.0-do.not.use
Secrets Engine v0.8.0
Linux (experimental)
Packages
Secrets Engine — the standalone engine binary
Recommended:
dbus— required for the keyring backends.gnome-keyringorkwallet— secret storage backend.
Configuration package — wires the engine into your Docker setup:
configures dockerd and makes docker pass available as a subcommand of the
Docker CLI.
Requirements:
- Secrets Engine standalone
- Docker Engine
>= 29.2.0— eitherdocker-ce(from Docker's apt repo) or
docker.io(from your distribution).
Install
# Replace with the files you downloaded (matching your distro and arch).
sudo apt install ./DockerSecretsEngine-linux-amd64-ubuntu2404.deb \
./DockerSecretsEnginePlugins-linux-ubuntu2404.deb
systemctl --user daemon-reload
systemctl --user enable --now docker-secrets-engine.serviceUninstall
systemctl --user disable --now docker-secrets-engine.service
sudo apt remove docker-secrets-engine-plugins docker-secrets-engineThis release was build from
github.com/docker/secrets-engine/client@v0.0.29github.com/docker/secrets-engine/plugin@v0.1.0github.com/docker/secrets-engine/plugins/pass@v0.2.0github.com/docker/secrets-engine/store@v0.2.0github.com/docker/secrets-engine/x@v0.1.0-do.not.use
Secrets Engine v0.7.3
Linux (experimental)
Packages
Secrets Engine — the standalone engine binary
Recommended:
dbus— required for the keyring backends.gnome-keyringorkwallet— secret storage backend.
Configuration package — wires the engine into your Docker setup:
configures dockerd and makes docker pass available as a subcommand of the
Docker CLI.
Requirements:
- Secrets Engine standalone
- Docker Engine
>= 29.2.0— eitherdocker-ce(from Docker's apt repo) or
docker.io(from your distribution).
Install
# Replace with the files you downloaded (matching your distro and arch).
sudo apt install ./DockerSecretsEngine-linux-amd64-ubuntu2404.deb \
./DockerSecretsEnginePlugins-linux-ubuntu2404.deb
systemctl --user daemon-reload
systemctl --user enable --now docker-secrets-engine.serviceUninstall
systemctl --user disable --now docker-secrets-engine.service
sudo apt remove docker-secrets-engine-plugins docker-secrets-engineThis release was build from
github.com/docker/secrets-engine/client@v0.0.29github.com/docker/secrets-engine/plugin@v0.1.0github.com/docker/secrets-engine/plugins/pass@v0.1.0github.com/docker/secrets-engine/store@v0.1.0github.com/docker/secrets-engine/x@v0.1.0-do.not.use
Secrets Engine v0.7.2
Linux (experimental)
Packages
Secrets Engine — the standalone engine binary
Recommended:
dbus— required for the keyring backends.gnome-keyringorkwallet— secret storage backend.
Configuration package — wires the engine into your Docker setup:
configures dockerd and makes docker pass available as a subcommand of the
Docker CLI.
Requirements:
- Secrets Engine standalone
- Docker Engine
>= 29.2.0— eitherdocker-ce(from Docker's apt repo) or
docker.io(from your distribution).
Install
# Replace with the files you downloaded (matching your distro and arch).
sudo apt install ./DockerSecretsEngine-linux-amd64-ubuntu2404.deb \
./DockerSecretsEnginePlugins-linux-ubuntu2404.deb
systemctl --user daemon-reload
systemctl --user enable --now docker-secrets-engine.serviceUninstall
systemctl --user disable --now docker-secrets-engine.service
sudo apt remove docker-secrets-engine-plugins docker-secrets-engineThis release was build from
github.com/docker/secrets-engine/client@v0.0.29github.com/docker/secrets-engine/plugin@v0.0.22github.com/docker/secrets-engine/plugins/pass@v0.1.0github.com/docker/secrets-engine/store@v0.1.0github.com/docker/secrets-engine/x@v0.0.33-do.not.use
Secrets Engine v0.7.1
Linux (experimental)
Packages
Secrets Engine — the standalone engine binary
Recommended:
dbus— required for the keyring backends.gnome-keyringorkwallet— secret storage backend.
Configuration package — wires the engine into your Docker setup:
configures dockerd and makes docker pass available as a subcommand of the
Docker CLI.
Requirements:
- Secrets Engine standalone
- Docker Engine
>= 29.2.0— eitherdocker-ce(from Docker's apt repo) or
docker.io(from your distribution).
Install
# Replace with the files you downloaded (matching your distro and arch).
sudo apt install ./DockerSecretsEngine-linux-amd64-ubuntu2404.deb \
./DockerSecretsEnginePlugins-linux-ubuntu2404.deb
systemctl --user daemon-reload
systemctl --user enable --now docker-secrets-engine.serviceUninstall
systemctl --user disable --now docker-secrets-engine.service
sudo apt remove docker-secrets-engine-plugins docker-secrets-engineThis release was build from
github.com/docker/secrets-engine/client@v0.0.29github.com/docker/secrets-engine/plugin@v0.0.22github.com/docker/secrets-engine/plugins/pass@v0.1.0github.com/docker/secrets-engine/store@v0.1.0github.com/docker/secrets-engine/x@v0.0.33-do.not.use
