[{"_1":2,"_153":-5,"_154":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_132":133},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":-5,"_85":86,"_125":-5,"_126":11,"_127":17,"_128":11,"_129":-5,"_130":131},"canonicalUrl","https://hub.docker.com/r/blockloop/vault-unseal/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","blockloop","reponame","vault-unseal","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":58,"_60":61,"_62":-5,"_63":64,"_65":66,"_67":11,"_68":29,"_69":70,"_75":11,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2017-01-16T19:09:25.237763Z","description","Unseal vault with a docker container. Works great as a kubernetes job.","is_private","last_updated","2017-01-16T19:43:56.290566Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",2545120,"repository_type","star_count",1,"status","status_description","active","source","collaborator_count",0,"full_description","# Vault Unsealer for Docker\n\nUnseal a [vault](https://www.vaultproject.io) with a docker container given only environment variables.\n\n[![Foo](https://img.shields.io/docker/pulls/blockloop/vault-unseal.svg)](https://hub.docker.com/r/blockloop/vault-unseal/)\n\nThis project was initially created to run as a kubernetes job to unseal a vault within the same cluster. This gives you the ability to pass env variables to a docker container and have it unseal a vault with the given keys. This image is based on the official vault image so many of the variables are the same. \n\n`VAULT_ADDR` - the location of the vault server. You must specify the protocol (i.e. VAULT_ADDR=http://vault:8200)\n\n`VAULT_UNSEAL_KEY_X` - this is the format of the unseal keys. In Kubernetes these are stored in a secret store and mounted to the Vault Unsealer Job as environment variables.\n\nThis container will loop up to 15 times, as many times as it can until vault is either unsealed or it returns an error. Each time it loops it checks the vault status and then, if the vault is still sealed, it runs `unseal` with the next key, or if it is unsealed, it exists 0. \n\n## Instructions\n\n1. Set vault key environment variables as `VAULT_UNSEAL_KEY_1`, `VAULT_UNSEAL_KEY_2`, etc. \n2. Set vault key address as `VAULT_ADDR`\n3. Optionally set `VAULT_SKIP_VERIFY` to 1. \n4. Check the [vault docs](https://www.vaultproject.io/docs/commands/environment.html) on environment variables to see all of your options. \n5. Run the container and watch it unseal your vault.\n\n## Example Kubernetes Config\n\n```yaml\n---\napiVersion: v1\nkind: Secret\nmetadata:\n name: vault-secret-config-s3\n namespace: default\ntype: Opaque\ndata:\n access_key: \n secret_key: \n unseal_key_1: \n unseal_key_2: \n unseal_key_3: \n unseal_key_4: \n unseal_key_5: \n root_token: \n\n---\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: vault-config-file\ndata:\n config.hcl: |-\n backend \"s3\" {}\n listener \"tcp\" {\n address = \"0.0.0.0:8200\"\n tls_disable = 1\n }\n\n---\napiVersion: extensions/v1beta1\nkind: Deployment\nmetadata:\n name: vault\nspec:\n replicas: 1\n template:\n metadata:\n labels:\n app: vault\n spec:\n volumes:\n - name: configmap\n configMap:\n name: vault-config-file\n containers:\n - name: vault\n image: vault:0.6.4\n args: [\"server\"]\n securityContext:\n capabilities:\n add:\n - IPC_LOCK\n ports:\n - containerPort: 8200\n imagePullPolicy: Always\n volumeMounts:\n - mountPath: /vault/config\n name: configmap\n env:\n - name: VAULT_ADDR\n value: http://127.0.0.1:8200\n - name: VAULT_SKIP_VERIFY\n value: \"1\"\n - name: AWS_S3_BUCKET\n value: \n - name: AWS_DEFAULT_REGION\n value: \n - name: AWS_ACCESS_KEY_ID\n valueFrom:\n secretKeyRef:\n name: vault-secret-config-s3\n key: access_key\n - name: AWS_SECRET_ACCESS_KEY\n valueFrom:\n secretKeyRef:\n name: vault-secret-config-s3\n key: secret_key\n - name: VAULT_TOKEN\n valueFrom:\n secretKeyRef:\n name: vault-secret-config-s3\n key: root_token\n\n---\napiVersion: v1\nkind: Service\nmetadata:\n creationTimestamp: null\n labels:\n app: vault\n name: vault\nspec:\n ports:\n - port: 8200\n protocol: TCP\n targetPort: 8200\n selector:\n app: vault\n sessionAffinity: None\n type: ClusterIP\n\n\n---\napiVersion: batch/v1\nkind: Job\nmetadata:\n name: vault-unseal\nspec:\n template:\n metadata:\n name: vault-unseal\n spec:\n restartPolicy: OnFailure\n containers:\n - name: vault-unseal\n image: blockloop/vault-unseal\n env:\n - name: VAULT_ADDR\n value: http://vault:8200\n - name: VAULT_SKIP_VERIFY\n value: \"1\"\n - name: VAULT_UNSEAL_KEY_1\n valueFrom:\n secretKeyRef:\n name: vault-secret-config-s3\n key: unseal_key_1\n - name: VAULT_UNSEAL_KEY_2\n valueFrom:\n secretKeyRef:\n name: vault-secret-config-s3\n key: unseal_key_2\n - name: VAULT_UNSEAL_KEY_3\n valueFrom:\n secretKeyRef:\n name: vault-secret-config-s3\n key: unseal_key_3\n\n```","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",16007228,"orgData","recentTags",[87],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_46":114,"_115":90,"_116":29,"_117":52,"_53":118,"_119":120,"_121":105,"_122":114,"_123":61,"_124":17},"content_type","creator",442256,"full_size",15981440,"id",7455060,"images",[97],{"_98":99,"_100":101,"_102":103,"_104":105,"_106":107,"_108":109,"_110":103,"_111":-5,"_112":92,"_59":61,"_113":-5},"architecture","amd64","digest","sha256:41bcab66bb0759f8b3887b7b2f22a282d5ff3c6e2fc7829eeb2d1c98e3870c62","features","","last_pulled","2026-09-20T07:38:01.809643293Z","last_pushed","2017-01-16T19:43:56Z","os","linux","os_features","os_version","size","variant","2017-01-16T19:43:55.748133Z","last_updater","last_updater_username","media_type","latest","repository",1178232,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":134,"_141":142,"_130":151,"_152":11},{"_36":135,"_38":136,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":137,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":58,"_60":61,"_62":-5,"_63":64,"_65":66,"_67":11,"_68":29,"_69":138,"_75":11,"_76":140,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":139},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_143":58,"_144":-5,"_145":-5,"_146":147},"count","next","previous","results",[148],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":149,"_46":114,"_115":90,"_116":29,"_117":52,"_53":118,"_119":120,"_121":105,"_122":114,"_123":61,"_124":17},[150],{"_98":99,"_100":101,"_102":103,"_104":105,"_106":107,"_108":109,"_110":103,"_111":-5,"_112":92,"_59":61,"_113":-5},[],"canDeleteTags","actionData","errors"]

blockloop/vault-unseal

Tags for blockloop/vault-unseal