<p>It would not be equally safe because you are running the container on a machine that is connected to the internet. Even if the guest is not compromised, the host could be, and that would compromise the guest.</p>
<p>Furthermore, docker containers are not even fully fledged virtual machines. They share the host's kernel as well as a lot of other components from the host system.</p>
<p>In the end, the software that you run in a docker container gets executed by something in the host OS, and that has the potential to leak information to an attacker who has compromised the host.</p>
<hr />
<p>Running Tails on an offline machine removes any existing OS as a factor since Tails is itself a fully fledged OS running on bare metal. You can ensure that the Tails you are running is that which is officially distributed, thereby ensuring that there isn't something else which has compromised it (of course there is the risk that Tails itself is compromised, but that's a different discussion). By physically disconnecting the device from the internet, there is no way for anything to leak to the internet.</p>

CC BY-SA 4.0
2020-12-28T18:24:24.873Z
2020-12-28T18:24:24.873Z
Ava Chow
<p>I am exploring options to generate Bitcoin private keys and addresses in most secure ways, using Ian Coleman's BIP39 tool. <a href="https://iancoleman.io/bip39/" rel="nofollow noreferrer">https://iancoleman.io/bip39/</a></p>
<p>The most recommended OS seems to be Tails OS for using this tool in completely offline mode.</p>
<p>If I used any other minimal linux image in docker, such that it never connects to internet , wouldn't that be equally safe ? We can also ensure to destroy the container and image from local storage after the address generation.</p>
<p>Do I really need Tails OS for this specific use case ?</p>

<coldstorage>
Question: Docker alternative to Tails OS for generating Bitcoin addresses securely for cold storage
John Smith
# Question: Docker alternative to Tails OS for generating Bitcoin addresses securely for cold storage

(Asked by: username_0 on 2020-12-28)

I am exploring options to generate Bitcoin private keys and addresses in most secure ways, using Ian Coleman's BIP39 tool. <https://iancoleman.io/bip39/>

The most recommended OS seems to be Tails OS for using this tool in completely offline mode.

If I used any other minimal linux image in docker, such that it never connects to internet , wouldn't that be equally safe ? We can also ensure to destroy the container and image from local storage after the address generation.

Do I really need Tails OS for this specific use case ?

**Tags:** coldstorage


---

## 1 answers

### Answer by username_1 on 2020-12-28. Score: 0 | Accepted answer

It would not be equally safe because you are running the container on a machine that is connected to the internet. Even if the guest is not compromised, the host could be, and that would compromise the guest.

Furthermore, docker containers are not even fully fledged virtual machines. They share the host's kernel as well as a lot of other components from the host system.

In the end, the software that you run in a docker container gets executed by something in the host OS, and that has the potential to leak information to an attacker who has compromised the host.

---

Running Tails on an offline machine removes any existing OS as a factor since Tails is itself a fully fledged OS running on bare metal. You can ensure that the Tails you are running is that which is officially distributed, thereby ensuring that there isn't something else which has compromised it (of course there is the risk that Tails itself is compromised, but that's a different discussion). By physically disconnecting the device from the internet, there is no way for anything to leak to the internet.


---

