🚀 Feature: Add custom keys and rotate key features to distroless #36

New Issue

OVERLORD · 2025-10-06T23:58:56+03:00

OVERLORD commented

2025-10-06 23:58:56 +03:00

Originally created by @lordraiden on GitHub.

Feature description

distroless doesn't have shell so this security feature can't be used
https://pocket-id.org/docs/advanced/custom-keys

Pitch

A solution would be to configure this via environmental variables in docker compose, for example

environment:
   - KEY_ALGORITHM=EdDSA
   - KEY_ALGORITHM_CRV=Ed25519 #only required for EdDSA
   - KEY_ROTATE=false #true for rotate on next restart

Originally created by @lordraiden on GitHub. ### Feature description distroless doesn't have shell so this security feature can't be used https://pocket-id.org/docs/advanced/custom-keys ### Pitch A solution would be to configure this via environmental variables in docker compose, for example ``` environment: - KEY_ALGORITHM=EdDSA - KEY_ALGORITHM_CRV=Ed25519 #only required for EdDSA - KEY_ROTATE=false #true for rotate on next restart ```

OVERLORD closed this issue

2025-10-06 23:58:57 +03:00

OVERLORD commented

2025-10-06 23:58:59 +03:00

@ItalyPaleAle commented on GitHub:

It should work as long as you use docker exec - you can see the docs too

# Adjust the container name if needed
docker exec -it pocket-id /app/pocket-id key-rotate -a EdDSA -c Ed25519

@ItalyPaleAle commented on GitHub: It should work as long as you use `docker exec` - you can see the docs too ```sh # Adjust the container name if needed docker exec -it pocket-id /app/pocket-id key-rotate -a EdDSA -c Ed25519 ```

OVERLORD commented

2025-10-06 23:59:00 +03:00

@lordraiden commented on GitHub:

The key-rotate command rotates the key that is used to sign tokens issued by Pocket ID. These are the tokens issued to OAuth clients (apps that use Pocket ID for auth), and the session tokens that keep you signed into Pocket ID.

Also note that if Pocket ID is running, you need to restart it for the new keys to be picked up

Passkeys are not encrypted in Pocket ID. Rotating the key has no impact on them, and it shouldn't - invalidating all passkeys would be destructive.

What about to choose the algorithm configuration per integration? would this be a thing? I have apps that support EdDSA and other only RSA? I guess I will what to stay with RSA.

Would be complex to implement to define several and choose in each integration which one to use?

@lordraiden commented on GitHub: > The key-rotate command rotates the key that is used to sign tokens issued by Pocket ID. These are the tokens issued to OAuth clients (apps that use Pocket ID for auth), and the session tokens that keep you signed into Pocket ID. > > > Also note that if Pocket ID is running, you need to restart it for the new keys to be picked up > > Passkeys are not encrypted in Pocket ID. Rotating the key has no impact on them, and it shouldn't - invalidating all passkeys would be destructive. What about to choose the algorithm configuration per integration? would this be a thing? I have apps that support EdDSA and other only RSA? I guess I will what to stay with RSA. Would be complex to implement to define several and choose in each integration which one to use?

OVERLORD commented

2025-10-06 23:59:00 +03:00

@lordraiden commented on GitHub:

It should work as long as you use docker exec - you can see the docs too

Adjust the container name if needed

docker exec -it pocket-id /app/pocket-id key-rotate -a EdDSA -c Ed25519

You are right, it worked but why it invalidate the logins to all the other apps and not to login to pocket id? I thought I would need to setup pocket ID from scratch but I was able to login with the same old passkeys in pocket ID. Why?

@lordraiden commented on GitHub: > It should work as long as you use `docker exec` - you can see the docs too > > # Adjust the container name if needed > docker exec -it pocket-id /app/pocket-id key-rotate -a EdDSA -c Ed25519 You are right, it worked but why it invalidate the logins to all the other apps and not to login to pocket id? I thought I would need to setup pocket ID from scratch but I was able to login with the same old passkeys in pocket ID. Why?

OVERLORD commented

2025-10-06 23:59:00 +03:00

@ItalyPaleAle commented on GitHub:

The key-rotate command rotates the key that is used to sign tokens issued by Pocket ID. These are the tokens issued to OAuth clients (apps that use Pocket ID for auth), and the session tokens that keep you signed into Pocket ID.

Also note that if Pocket ID is running, you need to restart it for the new keys to be picked up

Passkeys are not encrypted in Pocket ID. Rotating the key has no impact on them, and it shouldn't - invalidating all passkeys would be destructive.

@ItalyPaleAle commented on GitHub: The key-rotate command rotates the key that is used to sign tokens issued by Pocket ID. These are the tokens issued to OAuth clients (apps that use Pocket ID for auth), and the session tokens that keep you signed into Pocket ID. > Also note that if Pocket ID is running, you need to restart it for the new keys to be picked up Passkeys are not encrypted in Pocket ID. Rotating the key has no impact on them, and it shouldn't - invalidating all passkeys would be destructive.

OVERLORD commented

2025-10-06 23:59:01 +03:00

@ItalyPaleAle commented on GitHub:

That isn’t possible today, it was done like this by design. If you have a need for that could you please open a separate issue?

@ItalyPaleAle commented on GitHub: That isn’t possible today, it was done like this by design. If you have a need for that could you please open a separate issue?

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#36