Tag
The unknown storage type file error appears because OpenBao 2.7 removed the file backend, and the server stops as soon as it reads that configuration. Stop the container, back up the volume, migrate the data to PebbleDB with the 2.7.2 bao operator migrate and change the storage block: your unseal keys and token stay the same.
To install OpenBao with Docker, run the openbao/openbao:2.6.2 image with Raft storage on a volume, initialise it with bao operator init and unseal it with three of the five keys. OpenBao is the MPL 2.0 fork of HashiCorp Vault and keeps its API, so your applications read secrets the same way.
Docker Compose gives you three ways to pass configuration into a container: the environment key, the env_file attribute and the .env file for interpolation. For sensitive data, do not use environment variables; Docker Compose secrets are mounted as read-only files under /run/secrets/, away from logs and the process environment.
Vault centralises secrets with automatic rotation, a full audit trail and granular access policies. A practical guide for teams moving beyond a .env file: the concepts you actually need, the setup that works, and the mistakes that make the migration painful.
