A solution to provide keys on launch of e.g. a containerized application

[Canop]

The goal would be to let programs running in a container access some keys without using files.

One could imagine a scenario with a script asking you to open a certain drawer of SafeCloset before launching docker-compose (or equivalent). While the drawer stays open, it would accept requests for keys on a unix socket.

So we'd need a way to parameterize a drawer to accept those connections for a given duration.

Note: this is a preliminary discussion.