3rd party secrets-engine plugin backends

The secrets engine resolves se://<id> references through plugins. Below are candidate backends we're considering, grouped by where they fit in a user's workflow.

Locally-usable backends

Routinely used from a developer's machine, personal/team password managers, or self-hostable secret servers a developer authenticates to with a token.

1Password (ships ~~June 8, 2026 / Docker Desktop 4.77.0~~ delayed -> 4.78.0)
Bitwarden (with Vaultwarden as a self-hosted, API-compatible option)
LastPass
HashiCorp Vault
OpenBao

Cloud-deployment backends

Primarily used by workloads running in a cloud, reading secrets provisioned in that same cloud (IAM role, managed identity, workload identity).

AWS Secrets Manager
AWS SSM Parameter Store
Azure Key Vault
Google Cloud Secret Manager

Vote for the plugin you want most scroll down and react with 👍 on the comment for that backend. The more reactions a backend gets, the sooner it moves up our list.

Don't see your secret store? Drop a new comment with the backend you'd like supported and a short note on how you use it (personal workstation, CI, production workloads, …).

👍 this comment to vote for a Bitwarden plugin (also covers Vaultwarden, since it is API-compatible).

👍 this comment to vote for a LastPass plugin.

👍 this comment to vote for a HashiCorp Vault plugin.

👍 this comment to vote for an OpenBao plugin.

👍 this comment to vote for an AWS Secrets Manager plugin.

👍 this comment to vote for an AWS SSM Parameter Store plugin.

👍 this comment to vote for an Azure Key Vault plugin.

👍 this comment to vote for a Google Cloud Secret Manager plugin.

docs: link plugin-backends epic from README

SOPS?

Doppler?

Question: Securely Injecting Azure App Configuration into Docker Containers

We're currently using Azure App Configuration for app/feature settings in our workloads. While secret injection for credentials is clearly on the roadmap with Azure Key Vault support, does anyone here have recommendations, best practices, or tools for securely injecting (non-secret) app configs from Azure App Configuration into Docker containers at runtime—ideally with a workflow as seamless and secure as Secrets Engine's se:// references for secrets?

How are others handling config injection vs secret injection in containerized Azure environments?
Any known patterns or community plugins for bridging Azure App Configuration to Docker securely (without baking values into images/env files)?
Is this use case in scope for Secrets Engine, or would it require a separate or custom solution?
Thanks for any experience and pointers!

Phase.

PS: I am one of the developers. Would love to extend support from Phase if official Docker support isn't possible.

Keeper Security support would be great as well!

https://www.passwordstore.org/ 👉🏻 👈🏻 🥺

Even has a credential helper already
https://github.com/docker/docker-credential-helpers/blob/main/pass/pass.go

Hi folks!
For those who were waiting for 1password support for docker-ce, I've built the plugin

@joe0BAB

Hi @joe0BAB,

I maintain aquaman, an open-source credential proxy for AI agents. It already resolves secrets from HashiCorp Vault, Bitwarden, 1Password, KeePassXC, macOS Keychain, systemd-creds and an encrypted file, and ships as a plugin for OpenClaw and Hermes and as a hook adapter for Claude Code.

Two offers, happy to do either or both:

Standalone backends for this list. I am a big fan of Docker and very much a long time user of your core product - I can write individual plugins against the plugin/ SDK, starting with HashiCorp Vault, OpenBao and Bitwarden, with no dependency on aquaman so they work for anyone with a token. If that's useful, feel free to assign this epic (or those items) to me and I'll open PRs one backend at a time.
An aquaman plugin. One plugin that covers all of the backends above, plus what aquaman adds on top: a hash-chained, tamper-evident log of every secret read, and an allow-list so only declared references resolve. I'd much prefer to offer this one as well, for users who want the audit trail or run more than one vault.

Would you accept external plugins into this repo, or link community ones from the docs? Or are these backends planned in-house? Glad to align on structure before writing code - that's the easy part :)

I was not kidding about helping out here if you need a hand :)

Navigation Menu

Repository navigation

3rd party secrets-engine plugin backends #534

Locally-usable backends

Cloud-deployment backends

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

3rd party secrets-engine plugin backends #534

Description

Locally-usable backends

Cloud-deployment backends

Activity

joe0BAB commented on May 28, 2026

joe0BAB commented on May 28, 2026

joe0BAB commented on May 28, 2026

joe0BAB commented on May 28, 2026

joe0BAB commented on May 28, 2026

joe0BAB commented on May 28, 2026

joe0BAB commented on May 28, 2026

joe0BAB commented on May 28, 2026

tonsV2 commented on Jun 4, 2026

zoispag commented on Jun 11, 2026

mandarBadve commented on Jun 11, 2026

nimish-ks commented on Jun 11, 2026

jo-chemla commented on Jun 11, 2026

nikelborm commented on Jul 7, 2026

alikhil commented on Aug 16, 2026

tech4242 commented on Sep 23, 2026

tech4242 commented on Oct 7, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions