podman-secret-create(1)

💖 podman-secret-create(1) — General Commands Manual, bestie edition 💖

Okay so real quick, the vibes: this is podman-secret-create, straight out of the General Commands Manual, and it's about to become your new fave command. Buckle up. 🎀

---

✨ NAME ✨

podman-secret-create — create a new secret, no cap 🫶

---

🌸 SYNOPSIS 🌸

podman secret create [options] name file|-

---

🦋 DESCRIPTION 🦋

So like, this bad boy creates a secret — and it pulls the secret content from either standard input or from a file. Iconic behavior honestly. ✨

Create accepts a path to a file, or a -, and that little dash is basically you telling podman "girl read it from stdin". 💅

Now, what even is a secret? It's a blob of sensitive data that a container needs at runtime but that is not stored in the image or in source control. Think usernames and passwords, TLS certificates and keys, SSH keys, or literally any other important generic strings or binary content — up to 512 kB in size. It's giving vault energy. 🔐

Secrets are not committed to an image with podman commit, and they do not get committed in the archive created by a podman export command. They stay in their lane, and honestly? Respect. 👑

Secrets can also be used to store passwords for podman login to authenticate against container registries. Very much main character energy. 💫

---

💅 OPTIONS 💅

• --driver, -d=driver — specify the secret driver. Default is file. 🗂️
• --driver-opts=key1=val1,key2=val2 — specify driver specific options. Customize it, bestie. ⚙️
• --env=false — read secret data from an environment variable. 🌱
• --help — print usage statement. Your lil safety net. 🫶
• --ignore=false — if a secret with the same name already exists, do not return an error, and return the existing secret's ID instead of creating a new one. Cannot be used with --replace. The default is false. 🙈
• --label, -l=label — set metadata for the secret (e.g., --label mykey=value). Can be used multiple times. These labels can be viewed in podman secret inspect or podman secret ls. Tag it, slay. 🏷️
• --replace=false — if an existing secret with the same name already exists, update the secret. The --replace option does not change secrets within existing containers — only newly created containers. Cannot be used with --ignore. The default is false. 🔄

Heads up bestie: --ignore and --replace are mutually exclusive, fr fr. Pick one. 🚫

---

🧚 SECRET DRIVERS 🧚

file

The secret resides in a read-protected file. Simple, classic, does the job. 💜

pass

The secret resides in a GPG-encrypted file. Fancy AND secure. 🔥

shell

The secret is managed by custom scripts. An environment variable SECRET_ID is passed to the scripts (except for list), and secrets are communicated via stdin/stdout (where applicable). Driver options list, lookup, store, and delete serve to install the scripts:

[secrets]
driver = "shell"

[secrets.opts]
list =
lookup =
store =
delete =

DIY queen behavior honestly. 🛠️✨

---

🌈 EXAMPLES 🌈

Create the specified secret based on a local file.

echo -n mysecret > ./secret.txt
$ podman secret create my_secret ./secret.txt

Create the specified secret via stdin.

$ printf <secret> | podman secret create my_secret -

Create or rotate a cryptographically secure random secret just under the maximum 512000 bytes via stdin.

openssl rand -base64 378000 | podman secret create --replace my_secret -

Mount a local file-based secret securely in a container.

podman run --rm --secret source=my_secret,type=mount,uid=1001,gid=1001,mode=440 docker.io/library/alpine ls -l /run/secrets/my_secret

Create gpg encrypted secret based on a local file using the pass driver.

$ podman secret create --driver=pass my_secret ./secret.txt.gpg

Create a secret from an environment variable called 'MYSECRET'.

$ podman secret create --env=true my_secret MYSECRET

---

⭐ SEE ALSO ⭐

podman(1), podman-secret(1), podman-login(1), podman-run(1)

Go read them, they're all linked in the group chat. 💬

---

🎀 HISTORY 🎀

• January 2021, originally compiled by Ashley Cui acui@redhat.com <mailto:acui@redhat.com> — thank you queen 👑
• February 2024, added example showing secret creation from an environment variable by Brett Calliss brett@obligatory.email <mailto:brett@obligatory.email> — king behavior 🌱
• May 2025, added example showing secure secret generation / rotation & mounting by Stuart Cardall 🔥

---

and that's the whole page, bestie!! this was podman-secret-create(1) from the General Commands Manual — go forth and keep your secrets secret 💖🦋💅 periodt.