Docker has announced support for OpenID Connect (OIDC) connections for GitHub Actions, allowing Docker organizations to authenticate CI/CD workflows with short-lived, per-run tokens instead of stored Personal Access Tokens (PATs) or Organization Access Tokens (OATs). This feature, detailed in a new blog post, is available to organizations on Docker Team, Docker Business, or Docker Hardened Images plans.
- No more static secrets: Workflows no longer need to store long-lived credentials in GitHub secrets. Instead, they use OIDC tokens that are valid only for the duration of a single run, reducing the risk of credential leakage.
- Simplified secret rotation: With OIDC, there are no tokens to rotate manually. The tokens auto-expire, eliminating the operational overhead of managing PATs or OATs that can be accidentally committed or shared.
- GitHub Actions integration: The feature leverages GitHub's existing OIDC provider. You configure a connection in Docker Hub, then reference it in your workflow using the standard
permissions: id-token: writeblock and theactions/checkoutstep, with no custom scripts needed. - Secure by design: Each workflow run gets a unique token tied to the specific job and environment, ensuring that even if a token is compromised, its usefulness is minimal and time-limited.
For developers, this is a significant security upgrade. Previously, CI/CD pipelines often relied on static tokens stored in GitHub secrets, which could be exposed through misconfigured logs or supply-chain attacks. OIDC tokens eliminate that attack surface. Docker's implementation follows the same pattern used by cloud providers like AWS and Azure, making it familiar for teams already adopting OIDC. Setup is straightforward: navigate to your Docker Org settings, add an OIDC connection, and update your GitHub workflow to request the token. Docker provides clear documentation and examples to get started quickly, meaning you can adopt this best practice with minimal code changes.
By removing stored credentials from your pipeline, you not only tighten security but also simplify compliance and audit trails. This is a welcome move for any organization looking to modernize its CI/CD security posture.
Source: https://www.docker.com/blog/docker-oidc-connections-for-github-actions-available-for-docker-orgs/