gp42/aws-outbound-jwt-proxy repository overview

⁠Container image

aws-outbound-jwt-proxy is published as a multi-architecture container image on every GitHub Release.

⁠What it does

The proxy implements AWS outbound identity federation⁠. Instead of applications managing long-term API keys or passwords for third-party services, the proxy obtains a short-lived JSON Web Token from AWS STS on the workload's behalf and injects it into outgoing requests. The external service verifies the JWT against AWS's public OIDC discovery keys (signature, expiration, audience, and subject) before granting access. Token acquisition, caching, and renewal are transparent to the application.

See the project overview⁠ for the full picture.

⁠Registries

The same image is pushed to two registries under identical tags:

• Docker Hub: docker.io/gp42/aws-outbound-jwt-proxy
• GitHub Container Registry: ghcr.io/gp42/aws-outbound-jwt-proxy

Either works. GHCR has no anonymous pull rate limits; Docker Hub is the default for most tooling.

⁠Quick start

docker pull gp42/aws-outbound-jwt-proxy:latest

docker run --rm \
  -p 8080:8080 \
  -e UPSTREAM_HOST=api.example.com \
  -e UPSTREAM_SCHEME=https \
  -e TOKEN_AUDIENCE=https://api.example.com \
  gp42/aws-outbound-jwt-proxy:latest

All proxy flags can also be set via environment variables - see the Configuration reference⁠.

⁠Supported platforms

Each tag resolves to a multi-arch manifest list covering:

• linux/amd64
• linux/arm64

darwin images are not published - use the binary release⁠ for macOS.

⁠Tag policy

Tags pushed for each release are derived from the release kind:

Prereleases never move floating tags (latest, vX, vX.Y). Pin to vX.Y.Z for reproducible deployments; pin to vX.Y to track patch updates only; latest always points at the most recent stable release on both registries.

⁠Image properties

• Base image: gcr.io/distroless/static-debian13:nonroot (pinned by digest in the Dockerfile⁠). No shell, no package manager, minimal attack surface.
• User: runs as UID 65532 (nonroot). The container does not require root and cannot escalate.
• Entrypoint: /usr/local/bin/aws-outbound-jwt-proxy.
• Default port: the proxy listens on the address configured via LISTEN_ADDR / --listen-addr. Map the host port accordingly.

⁠OCI labels

Each image carries the following org.opencontainers.image.* labels:

Inspect with:

docker inspect --format '{{json .Config.Labels}}' gp42/aws-outbound-jwt-proxy:vX.Y.Z | jq

⁠Source

• Dockerfile⁠
• Release workflow⁠ - the docker job builds and pushes images using the same binaries that are attached to the GitHub Release.