Docker supports a credential-helper module[0], which supports 4 different backends for fetching the docker registry credentials: osxkeychain, pass, wincred, and

Docker supports a credential-helper module[0], which supports 4 different backends for fetching the docker registry credentials: osxkeychain, pass, wincred, and secretservice. pass lets you use GPG-smartcards, and many of those (such as Yubikeys) will let you enforce touch-policies for signing/encruption. As a combination of both these however, I must touch my Yubikey every time I pull a new docker image. Another cool use-case is that I use the terraform-pass-provider to save secrets for my personal terraform project. [0]: https://github.com/docker/docker-credential-helpers https://github.com/docker/docker-credential-helpers