sneakers·pamSneakers-PAM v0.1.0-rc.3 is out, now on Raspberry Pi
Privileged access,kept on a short leash™.
A vault for every privileged credential, with approvals, rotation and an audit trail nobody can quietly edit — delivered as a signed appliance you own outright.
$ sneakers-run -secret prod/db-primary -- psql
you can read this secret -- no approval needed
connecting to db-primary.example.org ...
logged: check-out by you, 08:14:02What it is
One place for every privileged credential.
Folders set the rules; nobody approves their own request, and one task gets one prompt.
A vault with folders and rules
Credentials live behind the access rules each folder sets, instead of spreadsheets, ticket comments and chat.
Check-out, requests and approvals
Reveals, check-outs and break-glass access can require a reason and, where set up, a second approver.
Rotation you can trust
A heartbeat checks that a target still matches what the vault holds, and rotation runs on a schedule or on demand.
An audit trail nobody can quietly edit
Every action is recorded in a hash-chained log; a changed, deleted or reordered record is detectable.
What makes it different
Built to be owned, not rented.
No per-seat pricing and no cloud account to open.
Open source
Apache-2.0, with no organisation-specific core. Read it, build it, or run someone else's build of it.
The MCP built in
An agent signs in with its own token, never a person's password, and uses a secret through the same approvals and audit trail a person would.
Strong security design
A signed, single-node appliance with its own rollback path, TPM-backed disk encryption, and nothing that trusts a request just because it asked twice.
Free
No tiers and no seat count. Run it on your own hypervisor, offline if you want to, or on Kubernetes down to a Raspberry Pi.
Download
v0.1.0-rc.3 is out
Published 2026-10-24. This is a prerelease: expect rough edges before v0.1.0.
| File | Size |
|---|---|
sneakers-appliance-0.1.0-rc.3-amd64.ovaAppliance OVA (install image) | 88.9 MiB |
sneakers-appliance-0.1.0-rc.3-amd64.ova.sha256OVA checksum | 106 B |
sneakers-product-0.1.0-rc.3-amd64.binProduct unit | 1021.1 MiB |
sneakers-appliance-baseOS-0.1.0-rc.3-amd64.binBase OS unit | 209.1 MiB |
sneakers-appliance-baseOS-patch-0.1.0-rc.2-to-0.1.0-rc.3-amd64.binBase OS patch (rc.2 to rc.3) | 15.8 MiB |
sneakers-appliance-baseWeb-0.1.0-rc.3-amd64.binBase web unit | 1.2 MiB |
SHA256SUMSChecksums for every file above | 570 B |
SHA256SUMS.sigstore.jsonSignature bundle for SHA256SUMS | 383 B |
All files are on the v0.1.0-rc.3 release page. No ISO this release: install from the OVA.
Run it on a Raspberry Pi
The OVA is for an amd64 hypervisor. From v0.1.0-rc.3 on, every service image is also built for linux/arm64, so the Helm charts install on a Kubernetes cluster on a Raspberry Pi (arm64). Get the charts from the v0.1.0-rc.3 release on sneakers-release, then set the arm64 values from the install guide's CPU architecture section.
How to verify
Check the files against the checksums:
sha256sum -c SHA256SUMS --ignore-missing
Then check that SHA256SUMS itself was signed with the production release key (cosign.pub, fingerprint 7774b27fa2cd7269ad1cf8259a278025f16cbd6af57a4597e0e67797021bfa4e):
cosign verify-blob --key cosign.pub \ --bundle SHA256SUMS.sigstore.json \ --insecure-ignore-tlog=true \ SHA256SUMS