HEhexalisk·Oct 13, 2016Submission
Crypt: Store and retrieve encrypted configs from etcd or consul
1 points · Open discussionxordataexchange
crypt
Go2015–2016
xordataexchange / crypt
crypt
Store and retrieve encrypted configs from etcd or consul
2Distinct people
2Mentions
0Explicit recommenders
523GitHub stars
What to know before exploring
What it is
Store and retrieve encrypted configs from etcd or consul
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by month2 dated mentions
Observed mentions: 2015-05-04 18:10:14 UTC to 2016-10-13 15:55:01 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| May 2015 | 2015-05-01 00:00:00 UTC | 2015-06-01 00:00:00 UTC | 1 | 0 | 1 |
| Jun 2015 | 2015-06-01 00:00:00 UTC | 2015-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2015 | 2015-07-01 00:00:00 UTC | 2015-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2015 | 2015-08-01 00:00:00 UTC | 2015-09-01 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2015 | 2015-09-01 00:00:00 UTC | 2015-10-01 00:00:00 UTC | 0 | 0 | 0 |
| Oct 2015 | 2015-10-01 00:00:00 UTC | 2015-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2015 | 2015-11-01 00:00:00 UTC | 2015-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2015 | 2015-12-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2016 | 2016-01-01 00:00:00 UTC | 2016-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2016 | 2016-02-01 00:00:00 UTC | 2016-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2016 | 2016-03-01 00:00:00 UTC | 2016-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2016 | 2016-04-01 00:00:00 UTC | 2016-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2016 | 2016-05-01 00:00:00 UTC | 2016-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2016 | 2016-06-01 00:00:00 UTC | 2016-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2016 | 2016-07-01 00:00:00 UTC | 2016-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2016 | 2016-08-01 00:00:00 UTC | 2016-09-01 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2016 | 2016-09-01 00:00:00 UTC | 2016-10-01 00:00:00 UTC | 0 | 0 | 0 |
| Oct 2016 | 2016-10-01 00:00:00 UTC | 2016-11-01 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
2 sourcesDo you mean the differences to the way I was setting up servers before CoreOS? Well, this is subjective, of course, but I feel that it's easier & faster to isolate everything now. I still have to add iptables rules (I also use AWS ports restrictions) and add SSH keys, but that's all I have to do. Auto updates with scheduled reboots and safe rollback work out of the box, I have only few vector attacks in terms of services exposed to the public network. When I have everything in 1 data center, "internal" tools (etcd, fleet, confd, locksmithd) are open only in private network and just ports 22, 80 & 443 have to be exposed. Containers are also "linked" in private network, I can easily securely connect services/applications in containers running on different machines without much overhead.
Often the easiest attack vector is/are security vulner
Read the rest
abilities in applications exposed to the public network. Containers are great here, because when application is compromised, just 1 particular container is dead (and probably other containers running that app). I can just run docker kill app && docker rm app and the rest of my containers are (probably) ok. The problem is that attacker can gain access to data in etcd, since it's not encrypted by default and has no per-user permission (but you can use HTTPS in etcd cluster, which is good), however as of now you can use something like crypt: https://github.com/xordataexchange/crypt to use gpg in etcd (with natural API).
Docker gives you root for everything in the container, which may not be the best option. Also, only lately Docker have the option to verify downloaded images. rkt already has this feature, and it's just 0.5.5. (see also: https://github.com/coreos/etcd/blob/master/Documentation/sec...). Docker is great, don't get me wrong, I think it's a very good software and I'm glad I can use it. CoreOS team has just a better vision and priorities, IMO.
I'm considering a blog post about CoreOS/Docker/rkt and similar tools, not sure if there's interest?