https://github.com/containersolutions/saferun

run binaries with encrypted environment variables
https://github.com/containersolutions/saferun

Last synced: 8 days ago
JSON representation

run binaries with encrypted environment variables

• Host: GitHub
• URL: https://github.com/containersolutions/saferun
• Owner: ContainerSolutions
• License: apache-2.0
• Created: 2022-01-26T10:54:23.000Z (almost 3 years ago)
• Default Branch: master
• Last Pushed: 2022-02-01T11:46:26.000Z (almost 3 years ago)
• Last Synced: 2024-06-20T02:09:37.770Z (5 months ago)
• Language: Go
• Size: 8.61 MB
• Stars: 3
• Watchers: 7
• Forks: 1
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# Saferun

Saferun is designed for the (now niched) cases where a host might contain several sensitive environment variables for applications, not only leading to a possible lack if the host gets targeted, as well as leading to a possible lack if the application itself gets attacked.

Saferun tackles that by allowing the use of encrypted environment variables to the hosts env.

## Getting Started

We start by creating an environment variable encrypted with a public key

```

export SAFE_RUN_DATABASE_PASSWORD=$(saferun encrypt --public-key=test.pub "my-unencrypted-password")

```

Then, we run the process with saferun and the private key

```

saferun run --private-key=test.key --only-encrypted /bin/env

```

The results will be an environment available for the process with every successfully decrypted environment available. The option `--only-encrypted` allows to control if the rest of the environment will be shared as well, or only the decrypted context.

## Using Two keys

Any set of applications should have its own private key to control what is available for its safe run. In order to do so, we can simply create two environment variables with different keys

```

export SAFE_RUN_app1=$(saferun encrypt --public-key=test.pub "app1_key")

export SAFE_RUN_app2=$(saferun encrypt --public-key=second.pub "app2_key")

```

Now, if we run app 1 with app1 key:

```

saferun run --private-key=test.key /bin/env

```

only app1 environment variable is available unencrypted. app2 is still available but encrypted (hence not useful for app1)