Is there a recommended way to use the Docker image management script with encrypted (password protected) keys?

The script seems to work fine if I don't protect my keys; but for protected keys there doesn't seem to be a way for Docker to prompt back to the command line for a password.

Could I possibly run tezos-signer separately and have the baker and endorser containers talk to that?


1 Answer 1


Yes you can run tezos-signer separately from source binary and then let it connect to tezos-node running in docker container. This is how you can do it.

On tezos-signer server run following 3 commands from directory where tezos-signer binary is downloaded:

  1. tezos-signer gen keys alice
  2. cat ~/.tezos-signer/public_key_hashs

This will output something like this: [ { "name": "alice", "value": "tz1abc..." } ]

Copy your public key hash which looks like "tz1abc..." above.

  1. tezos-signer launch socket signer -a home-ip

where home-ip is IP address of your server where tezos-signer is running. By default it uses port 7732

NOTE: Above command will prompt for password for your encrypted key, to start the signer deamon. You need to keep your deamon running in order for remote signer to work. So it is recommended to run it as background service. I recommend using tmux to do that.

Now on server where your docker is running, run following commands:

1) ./mainnet.sh client import secret key alice tcp://home-ip:7732/tz1abc...


home-ip is same as used in point 3 above

tz1abc... is same public key hash used in point 2 above

Above command will import the public key from singing server, but private key still remains on signing server. If you check the private keys file stored in docker container you'll find instead of private key this value would be store [{ "name": "alice", "value": "tcp://home-ip:7732/tz1abc...." }]

Baker running in container will automatically get the transaction signed from signing server using the above value by contacting the signing server where tezos-singer deamon must be in running state.

INFO: To check private keys stored in docker container use below process:

// To enter the shell mode in container

  1. docker exec -it mainnet_node_1 /bin/sh

// To enter the directory where keys are maintained in docker container

  1. cd /var/run/tezos/client/

  2. cat secret_keys

  • Followup question: How much resource would the signer daemon consume? I'm considering running it on a laptop (battery backup) with ledger. Wondering how beefy a laptop to get...? Commented Feb 3, 2019 at 21:09
  • @asbjornenge : probably good to ask your followup question as a new question. Feel free to reference to this one if you need to.
    – Ezy
    Commented Feb 3, 2019 at 22:25
  • 2
    @asbjornenge signer daemon should not consume much of your resources as all it does is sign the transactions on request. So if all you want is to run a signer daemon on it, a basic single processor, 2GB RAM, 60GB disk space would work. Commented Feb 4, 2019 at 6:47
  • Clear, thanks. That said, does this work with the new update pushed out a few days ago? I notice that mainnet.sh is no longer behaving (at least for me).
    – nurikabe
    Commented Feb 7, 2019 at 3:09
  • I don't find anything wrong with the new update. My setup is working fine. Can you elaborate your problem in a new question if you are still facing any problem? Commented Feb 12, 2019 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.