Release Secrets Engine v0.11.1 · docker/secrets-engine · GitHub
Skip to content

Secrets Engine v0.11.1

Latest
Latest

Choose a tag to compare

View all tags
@docker-read-write docker-read-write released this 21 Oct 16:41
· 9 commits to main since this release
v0.11.1
adf5138
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Linux (experimental)

Packages

Secrets Engine — the standalone engine binary

Recommended:

  • dbus — required for the keyring backends.
  • gnome-keyring or kwallet — secret storage backend.

Configuration package — wires the engine into your Docker setup:
configures dockerd and makes docker pass available as a subcommand of the
Docker CLI.

Requirements:

  • Secrets Engine standalone
  • Docker Engine >= 29.2.0 — either docker-ce (from Docker's apt repo) or
    docker.io (from your distribution).

Standalone binary

Linux (amd64 shown; substitute arm64 on ARM machines):

BASE="https://github.com/docker/secrets-engine/releases/download/v0.11.1"
curl -fsSLO "${BASE}/secrets-engine-linux_amd64.tar.gz"
curl -fsSLO "${BASE}/secrets-engine-linux_amd64.sha256"
curl -fsSLO "${BASE}/secrets-engine-linux_amd64.sigstore.json"
tar xzf secrets-engine-linux_amd64.tar.gz
sha256sum --check secrets-engine-linux_amd64.sha256
cosign verify-blob secrets-engine \
  --bundle secrets-engine-linux_amd64.sigstore.json \
  --certificate-identity "https://github.com/docker/secrets-engine/.github/workflows/sign-release.yml@refs/tags/v0.11.1" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Manual install

1. Secrets engine multipurpose binary

sudo install -D -m 0755 secrets-engine /usr/bin/docker-secrets-engine
# Optional: adds docker-pass to $PATH
sudo ln -sf docker-secrets-engine /usr/bin/docker-pass
sudo install -d -m 0755 /usr/libexec/docker-secrets-engine/plugins

The plugin directory must stay root-owned and world-readable only.

2. systemd user unit.

sudo tee /usr/lib/systemd/user/docker-secrets-engine.service >/dev/null <<'EOF'
[Unit]
Description=Docker secrets engine daemon
Documentation=https://docs.docker.com/

[Service]
Type=simple
ExecStart=/usr/bin/docker-secrets-engine
CacheDirectory=docker-secrets-engine
CacheDirectoryMode=0700
Restart=on-failure
RestartSec=2s

# Ensure a crash never leaves a core dump on disk for a same-UID peer to read.
LimitCORE=0

[Install]
WantedBy=default.target
EOF
systemctl --user daemon-reload
systemctl --user enable --now docker-secrets-engine

3. Configuring docker integration (optional)
Requires Docker Engine >= 29.2.0.

# 1. Create the plugin and config directories
sudo install -d -m 0755 \
  /usr/libexec/docker/cli-plugins \
  /usr/libexec/docker/nri-plugins \
  /var/log/docker-secrets-engine-plugins \
  /etc/docker/nri/conf.d

# 2. Link the binary into each plugin location
sudo ln -sf /usr/bin/docker-secrets-engine /usr/libexec/docker/cli-plugins/docker-pass
sudo ln -sf /usr/bin/docker-secrets-engine /usr/libexec/docker/nri-plugins/10-secrets-engine

# 3. Configure the NRI plugin to run as your user
echo "uid: $(id -u)" | sudo tee /etc/docker/nri/conf.d/10-secrets-engine.conf > /dev/null

# 4. Enable NRI in the Docker daemon config
sudo touch /etc/docker/daemon.json
docker-secrets-engine setup nri-config enable \
  < /etc/docker/daemon.json > /tmp/daemon.json \
  && sudo install -m 0644 /tmp/daemon.json /etc/docker/daemon.json

# 5. Restart Docker
sudo systemctl restart docker

The uid: line tells the root-run NRI plugin which user's daemon to target;
skip it for rootless dockerd. docker-secrets-engine setup nri-config enable
merges {"nri-opts": {"enable": true}} into daemon.json and keeps your
other keys.

Uninstall

# 1. Remove the Docker integration (skip if you did not configure it)
docker-secrets-engine setup nri-config disable \
  < /etc/docker/daemon.json > /tmp/daemon.json \
  && sudo install -m 0644 /tmp/daemon.json /etc/docker/daemon.json
sudo rm -f \
  /usr/libexec/docker/cli-plugins/docker-pass \
  /usr/libexec/docker/nri-plugins/10-secrets-engine \
  /etc/docker/nri/conf.d/10-secrets-engine.conf
sudo rm -rf /var/log/docker-secrets-engine-plugins
sudo systemctl restart docker

# 2. Stop and remove the systemd user unit
systemctl --user disable --now docker-secrets-engine
sudo rm -f /usr/lib/systemd/user/docker-secrets-engine.service
systemctl --user daemon-reload

# 3. Remove the binary and its plugin directory
sudo rm -f /usr/bin/docker-secrets-engine /usr/bin/docker-pass
sudo rm -rf /usr/libexec/docker-secrets-engine

Directories shared with Docker stay in place.

This release was build from

  • github.com/docker/secrets-engine/client@v0.2.2
  • github.com/docker/secrets-engine/plugin@v0.3.4
  • github.com/docker/secrets-engine/plugins/pass@v0.4.3
  • github.com/docker/secrets-engine/store@v0.4.3
  • github.com/docker/secrets-engine/x@v0.8.5
Assets 25
Loading