In simple English
This tool stores passwords and digital keys safely for your servers and apps. It decides which automated script or human worker gets to see each secret. You run it on your own server alongside a database to keep everything locked down. If you lose your master key, your stored secrets are gone forever. It takes time to set up and demands careful maintenance.
What it is
Conjur is an open-source secrets management and application identity server written in Ruby. It uses a PostgreSQL database (a structured system for storing app data in tables) to store encrypted credentials and access policies.
What it is good for
Solo builders who need enterprise-grade security for managing API keys, database passwords, and machine identities across multiple servers and deployment tools.
- Keeps sensitive passwords and API keys out of your plain-text configuration files.
- Supports role-based access control so every script only sees what it needs.
- Integrates smoothly with standard container platforms and deployment tools.
- Custom licence means you should review the terms before any commercial use.
- Requires running and maintaining a separate PostgreSQL database alongside Docker containers.
- Losing your master data key permanently destroys all stored secrets.
Hardcoding passwords in environment files or source code repositories.
Docker Compose and PostgreSQL for running the complete service stack.
- hashicorp/vault36k stars
Vault is a widely used alternative for secrets management with its own access policies and storage backends.
- Infisical/infisical30k stars
Infisical offers an open-source secrets manager with a simpler dashboard and built-in team features.
- future-architect/vuls12k stars
Scans Linux machines over SSH for installed software with publicly reported security holes.
- cossacklabs/acra1.5k stars
A proxy that encrypts individual database fields on the way in and decrypts them on the way out.
- 0xERR0R/blocky7.0k stars
A small DNS service for a home or office network that refuses to look up advertising and tracking addresses.
docker run --rm cyberark/conjur data-key generate docker run -d -p 8080:80 -e CONJUR_DATA_KEY="your_generated_key" cyberark/conjur