I am exploring options to generate Bitcoin private keys and addresses in most secure ways, using Ian Coleman's BIP39 tool. https://iancoleman.io/bip39/

The most recommended OS seems to be Tails OS for using this tool in completely offline mode.

If I used any other minimal linux image in docker, such that it never connects to internet , wouldn't that be equally safe ? We can also ensure to destroy the container and image from local storage after the address generation.

Do I really need Tails OS for this specific use case ?

1 Answer 1


It would not be equally safe because you are running the container on a machine that is connected to the internet. Even if the guest is not compromised, the host could be, and that would compromise the guest.

Furthermore, docker containers are not even fully fledged virtual machines. They share the host's kernel as well as a lot of other components from the host system.

In the end, the software that you run in a docker container gets executed by something in the host OS, and that has the potential to leak information to an attacker who has compromised the host.

Running Tails on an offline machine removes any existing OS as a factor since Tails is itself a fully fledged OS running on bare metal. You can ensure that the Tails you are running is that which is officially distributed, thereby ensuring that there isn't something else which has compromised it (of course there is the risk that Tails itself is compromised, but that's a different discussion). By physically disconnecting the device from the internet, there is no way for anything to leak to the internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.