Deploy with a private key

For a self-managed Compose host, encrypt .env.production and choose Local, storing the key in .env.keys:

$ dotenvx encrypt -f .env.production
$ dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production

Set DOTENV_PRIVATE_KEY_PRODUCTION to the returned value in the environment running Compose. The production Compose file passes it to the container and selects .env.production.

For a local check, after following Production to build hello-compose:production:

$ docker compose --env-file .env.keys -f compose.production.yaml up
$ docker compose --env-file .env.keys -f compose.production.yaml down

For deployment, use the host's secret-management workflow to supply the production key. Keep keys out of Dockerfile ARG and ENV instructions and out of git. Avoid printing resolved docker compose config output with real keys: it can include interpolated secret values.