sneakers·pamSneakers-PAM v0.1.0-rc.7 is out
Privileged access,kept on a short leash™.
A vault for every privileged credential, with approvals, rotation and an audit trail nobody can quietly edit — delivered as a signed appliance you own outright.
$ sneakers-run -secret prod/db-primary -- psql
you can read this secret -- no approval needed
connecting to db-primary.example.org ...
logged: check-out by you, 08:14:02What it is
One place for every privileged credential.
Folders set the rules; nobody approves their own request, and one task gets one prompt.
A vault with folders and rules
Credentials live behind the access rules each folder sets, instead of spreadsheets, ticket comments and chat.
Check-out, requests and approvals
Reveals, check-outs and break-glass access can require a reason and, where set up, a second approver.
Rotation you can trust
A heartbeat checks that a target still matches what the vault holds, and rotation runs on a schedule or on demand.
An audit trail nobody can quietly edit
Every action is recorded in a hash-chained log; a changed, deleted or reordered record is detectable.
What makes it different
Built to be owned, not rented.
No per-seat pricing and no cloud account to open.
Open source
Apache-2.0, with no organisation-specific core. Read it, build it, or run someone else's build of it.
The MCP built in
An agent signs in with its own token, never a person's password, and uses a secret through the same approvals and audit trail a person would.
Strong security design
A signed, single-node appliance with its own rollback path, TPM-backed disk encryption, and nothing that trusts a request just because it asked twice.
Free
No tiers and no seat count. Run it on your own hypervisor, offline if you want to, or on Kubernetes down to a Raspberry Pi.
Download
v0.1.0-rc.7 is out
Published 2026-11-03. This is a prerelease: expect rough edges before v0.1.0.
| Install target | Status | CPU |
|---|---|---|
| OVA, for VMware ESXi and vCenter | Available | amd64 only |
| Disk image (qcow2), for Proxmox VE | Available | amd64 only |
| Helm charts, for your own Kubernetes | Available | amd64 and arm64 |
| ISO, for bare metal | Not yet available | None published |
| AWS AMI | Being considered | None published |
The appliance is amd64 only: the OVA, the qcow2 and its update files. The Helm charts' images are built for amd64 and arm64.
Download the appliance
| File | Size |
|---|---|
sneakers-appliance-0.1.0-rc.7-amd64.ovaAppliance OVA (install image) | 95.4 MiB |
sneakers-appliance-0.1.0-rc.7-amd64.ova.sha256OVA checksum | 106 B |
sneakers-appliance-0.1.0-rc.7-amd64.qcow2Proxmox VE disk image (qcow2) | 228.9 MiB |
sneakers-appliance-0.1.0-rc.7-amd64.qcow2.sha256qcow2 checksum | 108 B |
sneakers-product-0.1.0-rc.7-amd64.binProduct unit | 1059.6 MiB |
sneakers-appliance-baseOS-0.1.0-rc.7-amd64.binBase OS unit | 228.2 MiB |
sneakers-appliance-baseOS-patch-0.1.0-rc.6-to-0.1.0-rc.7-amd64.binBase OS patch (rc.6 to rc.7) | 17.4 MiB |
sneakers-appliance-baseWeb-0.1.0-rc.7-amd64.binBase web unit | 1.2 MiB |
SHA256SUMSChecksums for every file above | 678 B |
SHA256SUMS.sigstore.jsonSignature bundle for SHA256SUMS | 383 B |
All files are on the v0.1.0-rc.7 release page. There's no ISO yet: a bare-metal install isn't available in this release.
Known issue: a box can stay stuck if it loses power right after the database move, so don't cut power during an upgrade to this release or straight after it. It's tracked in sneakers-appliance#579.
Install with Helm
The Helm charts install the same release on a Kubernetes cluster you run, on amd64 or arm64, down to a Raspberry Pi. The chart is charts/sneakers (version 0.1.0) in sneakers-release at the v0.1.0-rc.7 tag, installed from a checkout with global.imageTag=0.1.0-rc.7. On arm64, set the values from the install guide's CPU architecture section.
How to verify
Check the files against the checksums:
sha256sum -c SHA256SUMS --ignore-missing
Then check that SHA256SUMS itself was signed with the production release key (cosign.pub, fingerprint 7774b27fa2cd7269ad1cf8259a278025f16cbd6af57a4597e0e67797021bfa4e):
cosign verify-blob --key cosign.pub \ --bundle SHA256SUMS.sigstore.json \ --insecure-ignore-tlog=true \ SHA256SUMS