Docker

Encrypt a .env file for Docker, include it safely in your image, and inject its secrets when the container starts.

1. Encrypt

Encrypt your .env file before building the image. 
$ dotenvx encrypt
Commit the encrypted .env file, but never commit or copy .env.keys into the image. 
.env.keys

2. Add dotenvx to your image

Install dotenvx and use dotenvx run -- as the image entrypoint. Docker appends the existing CMD, so your application command stays easy to change. 
FROM node:22-alpine

RUN apk add --no-cache curl \
  && curl -sfS https://dotenvx.sh | sh \
  && apk del curl

WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .

ENTRYPOINT ["dotenvx", "run", "--"]
CMD ["node", "index.js"]

3. Run

For a local check, pass the private key from your ignored .env.keys file. 
$ docker build -t myapp .
$ docker run --env-file .env.keys myapp