Remove JFS references + secrets engine injection #247
+409
−927
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* cmd/secret: use new store Signed-off-by: Alano Terblanche <[email protected]> * Add temporary secrets engine client Signed-off-by: Alano Terblanche <[email protected]> * Lint fixes + remove tests + don't return cred value * update docs --------- Signed-off-by: Alano Terblanche <[email protected]> Co-authored-by: Saurabh Davala <[email protected]>
saucow
changed the title
saucow
commented
Nov 21, 2025
Comment on lines
41
to
42
| `{"pattern": "docker/mcp/generic/*"}`, // Generic secrets (docker pass) | ||
| `{"pattern": "docker/mcp/oauth/*"}`, // OAuth tokens |
Contributor
Author
There was a problem hiding this comment.
note: workaround as I wasn't able to query all with: docker/mcp/**
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What I did
Changes
Secret Injection
Container MCPs
Secrets injected as
se://URIs, resolved by Docker Desktop at container runtime. Gateway never holds secret values in memory.Remote MCPs
Secrets queried from Secrets Engine and expanded into HTTP headers. Actual values required for Bearer tokens and header interpolation.
OAuth Tokens
OAuth tokens retrieved from Secrets Engine in Desktop mode. Falls back to credential helpers in CE mode. Token refresh monitoring also uses Secrets Engine.
Commands Removed
docker mcp policy set/dump- Policy management incompatible with Secrets Engine access controldocker mcp secret export- Replaced by Secrets Engine queriesCommands Changed
docker mcp secret setStores secrets via
docker passto OS Keychain underdocker/mcp/generic/namespace.docker mcp secret lsQueries Secrets Engine HTTP API instead of JFS socket. JSON output format compatible with Docker Desktop UI.
docker mcp secret rmDeletes secrets via
docker pass rm. Only removesdocker-passprovider secrets. Legacy secrets must be removed via OS credential tools.