If /var/run/pcscd/pcscd.comm exists (from a host bind-mount),
the entrypoint now skips starting pcscd inside the container,
supporting the recommended pattern of running pcscd on the host.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The upgrade from Debian bookworm to trixie introduced a newer pcscd
that enforces polkit authorization by default. Since polkit is not
available inside containers, pcscd rejects connections with "access
was denied because of a security violation". Adding --disable-polkit
restores the previous behavior. Container-level isolation already
provides the security boundary that polkit would otherwise enforce.
Fixes#2607
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add additional DOCKER_STEPCA_INIT_* environment variables to entrypoint.sh so 'step ca init' also accepts the --root, --key, --key-password-file, --deployment-type and --with-ca-url arguments.
Add the management of the DOCKER_STEPCA_INIT_PASSWORD_FILE variable. over DOCKER_STEPCA_INIT_PASSWORD.
If both are used only DOCKER_STEPCA_INIT_PASSWORD_FILE will be used.
This commit removes the following deprecated binaries:
- step-awskms-init
- step-cloudkms-init
- step-pkcs11-init
- step-yubikey-init
From now on step and step-kms-plugin should be used to initialize the
PKI in AWS KMS, GCP KMS, PKCS#11 modules or YubiKeys.
A future commit will add step-kms-plugin to the docker images of
step-ca.
Fixes#1046
A `step-ca` instance created in a container can now be initialized
with Remote Management by setting `DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT`.
An ACME provisioner with default settings can be created at initialization
by setting `DOCKER_STEPCA_INIT_ACME`.
On systems with low resources the command `go mod download` can fail.
This causes long builds of the docker images. This change adds a new
layer in the docker build splitting the build and download in two
steps.
Fixes#1114
