sneakers·pamSneakers-PAM v0.1.0-rc.4 is out, now with a Proxmox VE image
Privileged access,kept on a short leash™.
A vault for every privileged credential, with approvals, rotation and an audit trail nobody can quietly edit — delivered as a signed appliance you own outright.
$ sneakers-run -secret prod/db-primary -- psql
you can read this secret -- no approval needed
connecting to db-primary.example.org ...
logged: check-out by you, 08:14:02What it is
One place for every privileged credential.
Folders set the rules; nobody approves their own request, and one task gets one prompt.
A vault with folders and rules
Credentials live behind the access rules each folder sets, instead of spreadsheets, ticket comments and chat.
Check-out, requests and approvals
Reveals, check-outs and break-glass access can require a reason and, where set up, a second approver.
Rotation you can trust
A heartbeat checks that a target still matches what the vault holds, and rotation runs on a schedule or on demand.
An audit trail nobody can quietly edit
Every action is recorded in a hash-chained log; a changed, deleted or reordered record is detectable.
What makes it different
Built to be owned, not rented.
No per-seat pricing and no cloud account to open.
Open source
Apache-2.0, with no organisation-specific core. Read it, build it, or run someone else's build of it.
The MCP built in
An agent signs in with its own token, never a person's password, and uses a secret through the same approvals and audit trail a person would.
Strong security design
A signed, single-node appliance with its own rollback path, TPM-backed disk encryption, and nothing that trusts a request just because it asked twice.
Free
No tiers and no seat count. Run it on your own hypervisor, offline if you want to, or on Kubernetes down to a Raspberry Pi.
Download
v0.1.0-rc.4 is out
Published 2026-10-30. This is a prerelease: expect rough edges before v0.1.0.
| File | Size |
|---|---|
sneakers-appliance-0.1.0-rc.4-amd64.ovaAppliance OVA (install image) | 94.2 MiB |
sneakers-appliance-0.1.0-rc.4-amd64.ova.sha256OVA checksum | 106 B |
sneakers-appliance-0.1.0-rc.4-amd64.qcow2Proxmox VE disk image (qcow2, new and untested on a real Proxmox VE host) | 222.8 MiB |
sneakers-appliance-0.1.0-rc.4-amd64.qcow2.sha256qcow2 checksum | 108 B |
sneakers-product-0.1.0-rc.4-amd64.binProduct unit | 1021.2 MiB |
sneakers-appliance-baseOS-0.1.0-rc.4-amd64.binBase OS unit | 222.0 MiB |
sneakers-appliance-baseOS-patch-0.1.0-rc.3-to-0.1.0-rc.4-amd64.binBase OS patch (rc.3 to rc.4) | 8.7 MiB |
sneakers-appliance-baseWeb-0.1.0-rc.4-amd64.binBase web unit | 1.2 MiB |
SHA256SUMSChecksums for every file above | 678 B |
SHA256SUMS.sigstore.jsonSignature bundle for SHA256SUMS | 383 B |
All files are on the v0.1.0-rc.4 release page. No ISO this release: install from the OVA, or on Proxmox VE from the qcow2 with the Proxmox VE guide. The qcow2 hasn't been tested on a real Proxmox VE host yet.
Run it on a Raspberry Pi
The OVA is for an amd64 hypervisor. From v0.1.0-rc.3 on, every service image is also built for linux/arm64, so the Helm charts install on a Kubernetes cluster on a Raspberry Pi (arm64). Get the charts from the v0.1.0-rc.4 release on sneakers-release, then set the arm64 values from the install guide's CPU architecture section.
How to verify
Check the files against the checksums:
sha256sum -c SHA256SUMS --ignore-missing
Then check that SHA256SUMS itself was signed with the production release key (cosign.pub, fingerprint 7774b27fa2cd7269ad1cf8259a278025f16cbd6af57a4597e0e67797021bfa4e):
cosign verify-blob --key cosign.pub \ --bundle SHA256SUMS.sigstore.json \ --insecure-ignore-tlog=true \ SHA256SUMS