[Support] Vault

Recommended Posts

Application Name: Vault

Application Sitehttps://www.vaultproject.io/

Docker Hubhttps://hub.docker.com/_/vault



Manage secrets and protect sensitive data. Create and secure access to tokens, passwords, certificates, and encryption keys.


Vault is a tool for securely accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, and more. Vault provides a unified interface to any secret, while providing tight access control and recording a detailed audit log.


Here is a video about this container.



This image is an official one, I do not manage it, though, I will do my best to support it here.


The app is going to install HashiCorp Vault with a file backend (default), you can change this backend if you want to, with other parameters in VAULT_LOCAL_CONFIG variable :

NOTE : At startup, the container will read configuration HCL and JSON files from /vault/config (any information passed into VAULT_LOCAL_CONFIG is written into local.json in this directory and read as part of reading the directory for configuration files).

Please see Vault's configuration documentation for a full list of options.

{"backend": {"file": {"path": "/vault/file"}},"listener": {"tcp": {"address": "", "tls_disable": 1}}, "ui": true}

Port :


Vault is using port 8200 (default).


Volumes :


We have two volumes in your installation :


- file : mandatory as you want the secrets to persist to your disks.

- logs : only if you want to audit logs. (commands in General usage section)


Setup :


You can setup  Vault from the WebUI, but I will go with the CLI.


After launching the app, install vault in your OS as a client : https://www.vaultproject.io/downloads


Set VAULT_ADDR to your Unraid server IP.


export VAULT_ADDR=''


Create key shares and set a threshold about how many keys you need to unseal Vault.


vault operator init -key-shares=6 -key-threshold=3


e.g output (Keep these keys and Root token safe and do not share them!):


Unseal Key 1: xDElr...IofCZFSvPe
Unseal Key 2: 2TQgn...vyQ7fSdSWR
Unseal Key 3: JALI...EpHFSw7SsI
Unseal Key 4: knzg...xEFwfwWSbKQ
Unseal Key 5: bJJmA...DSwfsddOTc
Unseal Key 6: xft8...aTdVSTYZg5

Initial Root Token: hvs.tnhE...y8NkA


Run unseal command 3 times with different keys every time (depends of your threshold number):

NOTE :  best practice would be to not write the key directly, and only type "vault operator unseal", so the keys is not in your cli history.

vault operator unseal xDElr...IofCZFSvPe
vault operator unseal 2TQgn...vyQ7fSdSWR
vault operator unseal knzg...xEFwfwWSbKQ


After 3 times running this command, you should see

Sealed          false


Now Vault is unsealed, you can login to vault :

NOTE :  best practice would be to not write the token directly, and only type "vault login", so the token is not in your cli history.

vault login hvs.tnhE...y8NkA


Example Usage :


There is many secret engine you can use : https://www.vaultproject.io/docs/secrets/

In this example, I will use the KV Engine as it's the most basic one.


Enable the KV (Key Value) Engine https://www.vaultproject.io/docs/secrets/kv :

vault secrets enable -version=1 -path=secret kv


Create our first secret :

vault kv put secret/my-vault/password password=123456


List our secret :

vault kv list secret/

vault kv list secret/my-vault/


Read the secret (defaults in table format):

vault kv get secret/my-vault/password
====== Data ======
Key         Value
---         -----
password    123456


Read the secret in json format:

vault kv get --format=json secret/my-vault/password
  "request_id": "31915c6c-2f8f-f7c4-146c-3dc81e80033c",
  "lease_id": "",
  "lease_duration": 2764800,
  "renewable": false,
  "data": {
    "password": "123456"
  "warnings": null


Read only the password value in the secret:

vault kv get -field=password secret/my-vault/password


Create a key with multiple secrets :

vault kv put secret/nextcloud/db db_name=nextcloud username=nextcloud_user password=secret


Read secrets in json

vault kv get --format=json secret/nextcloud/db
  "request_id": "db9604e4-f2eb-a529-c7f3-448b2846f565",
  "lease_id": "",
  "lease_duration": 2764800,
  "renewable": false,
  "data": {
    "db_name": "nextcloud",
    "password": "secret",
    "username": "nextcloud_user"
  "warnings": null


Only read username field :

vault kv get -field=username secret/nextcloud/db


Delete our secrets :

vault kv delete secret/nextcloud/db


If you want to activate the audit logs :

vault audit enable file file_path=/vault/logs/vault_audit.log


If you want to disable the audit logs : 

vault audit disable file


Vault is pretty fun and there is ton of different usages, from your bash scripts, in your code, in your CI/CD pipeline, SSH OTP, dynamic secrets, cloud provider authentication... have fun!


Please post any questions/issues relating to this docker you have in this thread.

Edited by kastem34
Being more concise
  • Like 2
Link to comment
  • 2 weeks later...

Can you use vault to store docker secrets? I am not aware of any way to based on the docs but thought I would ask. An example is, say, a DB connection you are passing creds to in a docker application in unraid.  I know you can use docker secrets (not easily in unraid) but vault would be nice to use for this.

Link to comment
  • 2 months later...
  • 2 months later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.