Skip to content


Since testcontainers-go v0.20.0


The Testcontainers module for Vault. Vault is an open-source tool designed for securely storing, accessing, and managing secrets and sensitive data such as passwords, certificates, API keys, and other confidential information.

Adding this module to your project dependencies

Please run the following command to add the Vault module to your Go dependencies:

go get

Usage example

The RunContainer function is the main entry point to create a new VaultContainer instance. It takes a context and zero or more Option values to configure the container.

    ctx := context.Background()

    vaultContainer, err := vault.RunContainer(ctx)
    if err != nil {

    // Clean up the container
    defer func() {
        if err := vaultContainer.Terminate(ctx); err != nil {


    ctx := context.Background()

    vaultContainer, err := vault.RunContainer(ctx, vault.WithToken("MyToKeN"))
    if err != nil {

    // Clean up the container
    defer func() {
        if err := vaultContainer.Terminate(ctx); err != nil {


    ctx := context.Background()

    vaultContainer, err := vault.RunContainer(ctx, vault.WithToken("MyToKeN"), vault.WithInitCommand(
        "auth enable approle",                         // Enable the approle auth method
        "secrets disable secret",                      // Disable the default secret engine
        "secrets enable -version=1 -path=secret kv",   // Enable the kv secret engine at version 1
        "write --force auth/approle/role/myrole",      // Create a role
        "write secret/testing top_secret=password123", // Create a secret
    if err != nil {

    // Clean up the container
    defer func() {
        if err := vaultContainer.Terminate(ctx); err != nil {

Use CLI to read data from Vault container:

exec, reader, err := vaultContainer.Exec(ctx, []string{"vault", "kv", "get", "-format=json", "secret/test1"})

The vaultContainer is the container instance obtained from RunContainer.

Use HTTP API to read data from Vault container:

request, _ := http.NewRequest(http.MethodGet, hostAddress+"/v1/secret/data/test1", nil)
request.Header.Add("X-Vault-Token", token)

response, err := http.DefaultClient.Do(request)

The hostAddress is obtained from the container instance. Please see here for more details.

Use client library to read data from Vault container:

Add Vault Client module to your Go dependencies:

go get -u
client, err := vaultClient.New(
assert.Nil(t, err)

err = client.SetToken(token)
assert.Nil(t, err)

s, err := client.Secrets.KvV2Read(ctx, "test1", vaultClient.WithMountPath("secret"))

Module Reference

The Vault module exposes one entrypoint function to create the containerr, and this function receives two parameters:

func RunContainer(ctx context.Context, opts ...testcontainers.ContainerCustomizer) (*VaultContainer, error)
  • context.Context, the Go context.
  • testcontainers.ContainerCustomizer, a variadic argument for passing options.

Container Options

When starting the Vault container, you can pass options in a variadic way to configure it.


If you need to set a different Vault Docker image, you can use testcontainers.WithImage with a valid Docker image for Vault. E.g. testcontainers.WithImage("hashicorp/vault:1.13.0").


Default image name is hashicorp/vault:1.13.0.


Image Substitutions

In more locked down / secured environments, it can be problematic to pull images from Docker Hub and run them without additional precautions.

An image name substitutor converts a Docker image name, as may be specified in code, to an alternative name. This is intended to provide a way to override image names, for example to enforce pulling of images from a private registry.

Testcontainers for Go exposes an interface to perform this operations: ImageSubstitutor, and a No-operation implementation to be used as reference for custom implementations:

// ImageSubstitutor represents a way to substitute container image names
type ImageSubstitutor interface {
    // Description returns the name of the type and a short description of how it modifies the image.
    // Useful to be printed in logs
    Description() string
    Substitute(image string) (string, error)
type NoopImageSubstitutor struct{}

// Description returns a description of what is expected from this Substitutor,
// which is used in logs.
func (s NoopImageSubstitutor) Description() string {
    return "NoopImageSubstitutor (noop)"

// Substitute returns the original image, without any change
func (s NoopImageSubstitutor) Substitute(image string) (string, error) {
    return image, nil

Using the WithImageSubstitutors options, you could define your own substitutions to the container images. E.g. adding a prefix to the images so that they can be pulled from a Docker registry other than Docker Hub. This is the usual mechanism for using Docker image proxies, caches, etc.

Wait Strategies

If you need to set a different wait strategy for the container, you can use testcontainers.WithWaitStrategy with a valid wait strategy.


The default deadline for the wait strategy is 60 seconds.

At the same time, it's possible to set a wait strategy and a custom deadline with testcontainers.WithWaitStrategyAndDeadline.

Startup Commands

Testcontainers exposes the WithStartupCommand(e ...Executable) option to run arbitrary commands in the container right after it's started.


To better understand how this feature works, please read the Create containers: Lifecycle Hooks documentation.

It also exports an Executable interface, defining the following methods:

  • AsCommand(), which returns a slice of strings to represent the command and positional arguments to be executed in the container;
  • Options(), which returns the slice of functional options with the Docker's ExecConfigs used to create the command in the container (the working directory, environment variables, user executing the command, etc) and the possible output format (Multiplexed).

You could use this feature to run a custom script, or to run a command that is not supported by the module right after the container is started.


  • Not available until the next release of testcontainers-go main

By default, the container is started in the default Docker network. If you want to use a different Docker network, you can use the WithNetwork(networkName string, alias string) option, which receives the new network name and an alias as parameters, creating the new network, attaching the container to it, and setting the network alias for that network.

If the network already exists, Testcontainers for Go won't create a new one, but it will attach the container to it and set the network alias.

Docker type modifiers

If you need an advanced configuration for the container, you can leverage the following Docker type modifiers:

  • testcontainers.WithConfigModifier
  • testcontainers.WithHostConfigModifier
  • testcontainers.WithEndpointSettingsModifier

Please read the Create containers: Advanced Settings documentation for more information.


If you need to add token authentication, you can use the WithToken.



If you need to run a vault command in the container, you can use the WithInitCommand.

testcontainervault.WithInitCommand("secrets enable transit", "write -f transit/keys/my-key"),
testcontainervault.WithInitCommand("kv put secret/test1 foo1=bar1"),

Container Methods


This method returns the http host address of Vault, in the http://<host>:<port> format.

hostAddress, err := vaultContainer.HttpHostAddress(ctx)