geoffreybooth/vault-dev repository overview

⁠Vault Development Docker Image

Docker image based on upstream official Vault image which allows pre-populating with secrets for local development/testing. DO NOT USE FOR PRODUCTION PURPOSES.

⁠Secrets

On startup, Vault will read secrets from a file or environment variable and write them into the generic secret backend.

If you have your secrets saved in a JSON file, you can pass them in as a volume, e.g. --volume $PWD/localhost-secrets.json:/opt/secrets.json. Vault looks for secrets at the path defined by $VAULT_SECRETS_FILE, which by default is /opt/secrets.json. Override that variable to change where Vault should load the secrets from.

You can also pass secrets in via an environment variable, $VAULT_SECRETS. This should be a JSON string. If both the secrets file and the environment variable are present, the file takes precedence.

The contents of the JSON file or environment variable is an object associating a path with value, as follows:

{
  "secret/foo/bar": "baz",
  "secret/something/else": {
    "someKey": "someValue",
    "anotherKey": "anotherValue"
  }
}

If you see errors in your Vault client about Invalid path for a versioned K/V secrets engine, set the vault-dev container VAULT_USE_V1_API environment variable to secret. This recreates⁠ the /secret engine using v1 of the Vault API. Here’s example usage in docker-compose.yml:

  vault:
    image: geoffreybooth/vault-dev
    volumes:
      - ./secrets.json:/opt/secrets.json
    environment:
      VAULT_USE_V1_API: secret
    ports:
      - '8200:8200'

⁠Backends

The following backends can be enabled by setting the appropriate environment variable to 1:

• App ID: $VAULT_USE_APP_ID

⁠App ID

If the app ID backend is enabled, app ID profiles can be created by setting the file at /opt/app-id.json (override path with $VAULT_APP_ID_FILE, or set contents to $VAULT_APP_ID environment variable as with $VAULT_SECRETS above):

[
  {
    "name": "app-id-1",
    "policy": "root",
    "user_ids": [
      "asdf",
      "qwerty"
    ]
  },
  {
    "name": "app-id-2",
    "policy": "root",
    "user_ids": [
      "mary",
      "fred"
    ]
  }
]

⁠Policies

Policies can be created by specifying the file at /opt/policies.json (override path with $VAULT_POLICIES_FILE, or set contents to $VAULT_POLICIES environment variable as with $VAULT_SECRETS above) as follows:

{
  "policy1": "path \"secret/*\" { policy = \"write\" }"
}

⁠Healthcheck

The native Docker healthcheck will return healthy when all configured secrets have been written.

⁠Authentication

The upstream vault image is mostly unmodified so it runs Vault in development by default (no auth necessary) and also respects the environment variable VAULT_DEV_ROOT_TOKEN_ID.

See https://hub.docker.com/_/vault/⁠ for details.

⁠Docker Registry

https://hub.docker.com/r/geoffreybooth/vault-dev/⁠

⁠Source

Forked from https://github.com/dollarshaveclub/vault-dev-docker⁠