openbao/openbao-ubi repository overview

⁠Quick Reference

• Maintained by:
  OpenBao Maintainers⁠

• Documentation:
  https://openbao.org/docs/⁠

• Support & Community:
  GitHub Discussions⁠

⁠What is OpenBao?

OpenBao⁠ is an identity-based secrets and encryption management system, governed openly as part of the Linux Foundation Edge⁠.

⁠How to use this image

Running the OpenBao container with no arguments will give you an OpenBao server in development mode⁠⁠. The provided entry point script let you pass OpenBao CLI subcommands directly, e.g.:

$ docker run openbao status

The entry point also adds some special configuration options as detailed in the sections below when running the server subcommand.

The image uses dumb-init as the entrypoint to handle signal forwarding and zombie process reaping. Any command other than bao is executed under dumb-init.

OpenBao binaries are signed with a GPG key⁠ and Cosign⁠. See the installation docs⁠ for verification steps.

⁠Running OpenBao in Development Mode

The following command spawns an initialized and unsealed OpenBao instance. It is the equivalent of running bao server -dev -dev-root-token-id root.

$ docker run \
    --name openbao-dev \
    --detach \
    openbao

The command runs an in-memory OpenBao instance, which should be used exclusively for development purposes.

To follow the logs use

$ docker logs -f openbao-dev

⁠Options

Additional options for development purposes:

Example:

$ docker run \
    --name openbao-dev \
    --env BAO_DEV_ROOT_TOKEN_ID="foobar" \
    --env BAO_DEV_LISTEN_ADDRESS="0.0.0.0:1337" \
    --publish 1337:1337 \
    openbao/openbao

⁠Running OpenBao in Server Mode

$ docker run \
    --name openbao \
    --detach \
    --volume /openbao/config:/openbao/config \
    --publish 8200:8200 \
    openbao/openbao

Then you can hit http://localhost:8200 or http://host-ip:8200 in your browser.

⁠Configuring OpenBao

The container has an OpenBao configuration directory set up at /bao/config and the server will load any HCL or JSON configuration files placed here by binding a volume or by composing a new image and adding files. Alternatively, configuration can be added by passing the configuration JSON via environment variable BAO_LOCAL_CONFIG.

The container OpenBao container exposes two optional VOLUMEs:

• /openbao/logs, to use for writing persistent audit logs. By default nothing is written here; the file audit backend must be enabled with a path under this directory.
• /openbao/file, to use for writing persistent storage data when using thefile data storage plugin. By default nothing is written here (a dev server uses an in-memory data store); the file data storage backend must be enabled in OpenBaos's configuration before the container is started.

⁠Image Variants

The openbao images come in many flavors, each designed for a specific use case.

⁠License

View license information⁠⁠ for the software contained in this image.

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.