Hi!

I just discovered that 1password has 2 containers in the Unraid App Store, and that got me thinking:

Is it possible to retrieve secrets from a 1password vault directly into the creation of docker containers via the Docker Web GUI?

I'm thinking of the ability to fill out environment variables with a secret name from the 1password vault instead of the API key (example) directly.

That would have been SO nice.

Let's face it; having all those API keys etc exposed when creating a multitude of containers isn't the best security

21 hours ago, Dal said:

Hi!

I just discovered that 1password has 2 containers in the Unraid App Store, and that got me thinking:

Is it possible to retrieve secrets from a 1password vault directly into the creation of docker containers via the Docker Web GUI?

I'm thinking of the ability to fill out environment variables with a secret name from the 1password vault instead of the API key (example) directly.

That would have been SO nice.

Let's face it; having all those API keys etc exposed when creating a multitude of containers isn't the best security

Might be worth a read?

https://www.1password.dev/connect/get-started

It is unfortunate that native 1Password is not supported when setting up containers on docker in Unraid. It would be nice if the env variables would somehow support op://Infrastructure/Postgres/password as a variable and inject the secret into the container, but that is not the case.

The core Docker template editor (dockerMan) is part of Unraid’s built-in code.

There is no clean public plugin hook that lets you intercept every environment variable field, resolve op:// references on the fly while the user is filling out the form, and keep the reference stored in the template while injecting the value only at create/update time.

To get true “type op://... in the Value field and it just works” behaviour you would need one of:

• Deep (and fragile) patching/monkey-patching of the template PHP/JS

• A completely parallel “Secrets-aware Add/Edit Container” UI that bypasses the stock form

• Cooperation from Lime Technology to add an official secrets provider interface

Alternatives, which I am really not sure if I am happy with personally would be a plugin that somehow expands on the Compose Manager Plus plugin. And have op run wrap the docker compose and I think there could be something there to explore. This is not ideal.

The best scenario would be built in secrets manager support for different password managers.