since I'm writing this locally as well, decided to omit the mention of the docker volume

This isn't exactly what @varun asked for. Not sure if that was intentional or not

I think we can just say "authentication of a password" instead of "authentication of a password user". We don't explain the concept of a "password user" anywhere else in the docs, nor should we need to in order to explain what OPAQUE is.

the file option still needs a file, not a directory

the keygen program creates the secrets directory i think. is there a way we can avoid calling mkdir ourselves and still avoid Docker creating it as sudo user?

edit: the documented steps actually don't even work for me. getting this error:

Creating secrets directory "secrets"
Error: Os { code: 13, kind: PermissionDenied, message: "Permission denied" }

we don't need this, since we'll look for the file if the env var isn't present

Rewritten

do you mind doing ls -lg and see who owns the directory? If you already have a secrets directory, it could be causing issues.

I was also tempted with just saying to run cargo run -- keygen. But then I would need a step saying to download cargo.

I either need to mount a secrets directory or expose the environment variable. Having neither will not work. I went with an environment variable since that is closer to what we want to use with ECS.

Docker volumes also seem more prone to UID and GID issues between the host and container.

+1