grain
Install

guides

Secrets

Store secrets on the host and materialize them into a guest VM without baking them into images.

Host store

Secrets live under ~/.grain/secrets/<name>/ (directory mode 0700, data 0600).

bash 
grain secret set db-pass --value 's3cret'
grain secret set tls-key --from-file ./key.pem --mode 0600
grain secret ls

Inject into a VM

Requires a healthy guest agent:

bash 
grain secret inject sbox-1 db-pass
# default path: /run/grain/secrets/db-pass

grain secret inject sbox-1 db-pass --path /etc/app/secret

API

MethodPath
GET/POST/secrets
GET/PATCH/DELETE/secrets/{name}
POST/vms/{name}/secrets/{secretName}

Compared to the egress proxy

FeatureSecrets injectEgress proxy
Where secret livesFile inside the guestOnly on the host; injected on matching HTTP(S) requests
Best forConfig files, certs, app secrets the process must readAPI tokens you do not want in the sandbox filesystem

Use inject for material the guest software must open as a file. Use the proxy when the guest should never see the raw credential.