# Mount your files

[← Back to Docker Compose](https://dotenvx.com/docs/docker-compose.md#ship)

Keep configuration outside the image. Change the main Dockerfile to copy only your app:

```dockerfile
COPY index.js ./
```

Replace compose.yaml with:

```yaml
services:
  app:
    build: .
    volumes:
      - type: bind
        source: ./.env
        target: /app/.env
        read_only: true
        bind:
          create_host_path: false
      - type: bind
        source: ./.env.keys
        target: /app/.env.keys
        read_only: true
        bind:
          create_host_path: false
```

Create and encrypt .env before running this. Both source files must exist; create_host_path: false prevents a missing file from silently becoming a directory.

```console
$ docker compose up --build
$ docker compose down
```

The source paths are relative to your Compose file and must be available on the Docker host. No --env-file option is needed: Dotenvx reads the mounted files directly.

For production, mount the encrypted production file, select it with DOTENV_FILE, and supply its key separately through runtime secrets. See [Docker's mounted-file alternative](https://dotenvx.com/docs/docker/mount-files.md) for the distinction between mounted files and already-injected ciphertext.