Share feedback
Answers are generated based on the documentation.

docker pass

内容説明Manage your local OS keychain secrets.
利用方法docker pass set|get|ls|rm

試験的

このコマンドは試験的なものです。

試験的機能はテスト向けに意図されたものであり、その機能に関してのフィードバックを得る目的があります。 この機能はリリース時に予告なく変更される場合があり、また今後のリリースに向けて削除されることがあります。

内容説明

Docker Pass is a helper for securely storing secrets in your local OS keychain and injecting them into containers when needed. It uses platform-specific credential storage:

  • Windows: Windows Credential Manager API
  • macOS: Keychain services API
  • Linux: org.freedesktop.secrets API (requires DBus + gnome-keyring or kdewallet)

Secrets can be injected into running containers at runtime using the se:// URI scheme.

利用例

Using keychain secrets in containers

Create a secret:

$ docker pass set GH_TOKEN=123456789

Create a secret from STDIN:

echo "my_val" | docker pass set GH_TOKEN

Run a container that uses the secret:

$ docker run -e GH_TOKEN= -dt --name demo busybox

Inspect the secret from inside the container:

$ docker exec demo sh -c 'echo $GH_TOKEN'
123456789

Explicitly assign a secret to a different environment variable:

$ docker run -e GITHUB_TOKEN=se://GH_TOKEN -dt --name demo busybox

Using keychain secrets in Compose

Store the secrets:

$ docker pass set myapp/anthropic/api-key=sk-ant-...
$ docker pass set myapp/postgres/password=s3cr3t

services:
  api:
    image: service1
    environment:
      - ANTHROPIC_API_KEY=se://myapp/anthropic/api-key
      - POSTGRES_PASSWORD=se://myapp/postgres/password

  worker:
    image: service2
    command: worker
    environment:
      - ANTHROPIC_API_KEY=se://myapp/anthropic/api-key

  db:
    image: postgres:17
    environment:
      - POSTGRES_PASSWORD=se://myapp/postgres/password

サブコマンド

コマンド内容説明
docker pass getGet a secret from a keystore.
docker pass lsList all secrets from local keychain.
docker pass rmRemove secrets from local keychain.
docker pass setSet a secret