OpenBao in Docker?

[qovzeash]

I just got to know the project and would like to know if anyone has already tried implementing OpenBao in a “docker-compose.yml” file? I was thinking of testing it by adding some environment variables to a container, but I haven’t found any documentation for it yet.

[cipherboy]

\o hello @qovzeash -- not to my knowledge! We have a helm chart which might be useful as a starting point. However, OpenBao should run fine in a single container unless you are trying to do a HA setup.

[jmls]

we use openbao in a docker compose with postgres as the store. Works wonderfully ;)

[jmls]

sure. Here is a basic example to start with a postgres db and the default openbao/openbao image

Starts a bao server in dev mode.

I've left the traefik labels in to get the stack to work behind a traefik proxy. If you don't want to use traefik , uncomment the "ports" section to bind localhost 8200 to the bao port

create a file called "bao.conf" with this content

storage "postgresql" {
  table = "openbao_kv_store"
  path    = "openbao/"
}

listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = true
}

api_addr = "http://0.0.0.0:8200"
plugin_directory = "/openbao/plugins"

and a docker-compose.yml file with this content

version: '3.7'
volumes:
  pg_data:

networks:
  openbao:
  traefik:
    external: true

services:
  db:
    image: pgautoupgrade/pgautoupgrade:17-alpine
    environment:
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_DB=${POSTGRES_DB:-openbao}
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -h localhost -U ${POSTGRES_USER} -d ${POSTGRES_DB:-openbao}']
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      openbao:
    volumes:
      - pg_data:/var/lib/postgresql/data

  openbao:
    image: openbao/openbao:2.1.0
    command: ['server', '-config=/openbao/config/bao.conf']

    cap_add:
      - IPC_LOCK
    # ports:
    #   - 8200:8200
    depends_on:
      db:
        condition: service_healthy
    environment:
      - VAULT_ADDR=http://127.0.0.1:8200
      - VAULT_DISABLE_MLOCK=true
      - VAULT_PG_CONNECTION_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-openbao}?sslmode=disable
    healthcheck:
      interval: 2s
      retries: 10
      start_period: 5s
      test: 'wget --spider  http://127.0.0.1:8200/v1/sys/seal-status || exit 1'
      timeout: 10s
    labels:
      - 'traefik.enable=true'
      - 'traefik.docker.network=traefik'
      - 'traefik.http.routers.${STACK}-openbao.rule=Host(`${OPENBAO_HOST}`)'
      - 'traefik.http.routers.${STACK}-openbao.entrypoints=websecure'
      - 'traefik.http.routers.${STACK}-openbao.tls.certresolver=myresolver'
      - 'traefik.http.services.${STACK}-openbao.loadbalancer.server.port=8200'
    volumes:
      - ./bao.conf:/openbao/config/bao.conf
    networks:
      openbao:

then run docker compose up

[jmls]

we use the "pgautoupgrade" image for our postgres db container, as it can automatically upgrade the postgres version on startup. So, for example, if we deploy this compose, all stacks with postgres-16 databases are updated to postgres-17 on startup. Very useful.

Of course, if you want a fancy name for the stack (instead of the parent directory name) use the "-p" option

docker compose -p my_awesome_openbao_stack up

and to run it in the background

docker compose -p my_awesome_openbao_stack up -d

[qovzeash]

@jmls thank you for sharing your example. Reading my question now, I realized how poorly I wrote it. However, reflecting on this question a few weeks later, I can reformulate it. My question is more about finding an alternative to using a .env file in Docker Compose. My main idea is to use secrets from OpenBao directly in a Docker Compose file. I know there is a Secrets operator for Kubernetes, but for my testing scenario, I was considering this approach.

[cipherboy]

@qovzeash If you can modify your application, you can use the OpenBao API to acquire secrets directly. However, if you want to directly emulate it, you might be able to get away with a shared volume and running OpenBao Agent to write secrets into the volume.

[qovzeash]

@cipherboy I moved to the approach you mentioned, and everything works fine. Thanks, lads, for the time dedicated to the matter.