# Deploy with a private key

[← Back to Docker](https://dotenvx.com/docs/docker.md#production)

For a deployment without Armor Enclaves, encrypt .env.production and choose **Local**, storing its key in .env.keys:

```console
$ dotenvx encrypt -f .env.production
$ dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production
```

Set DOTENV_PRIVATE_KEY_PRODUCTION to the returned value in your container platform's runtime secret settings. Set DOTENV_FILE to .env.production.

Example deployment environment variables:

```dotenv
DOTENV_PRIVATE_KEY_PRODUCTION="c09d6f8918835c82f0df3b7d100c501ac199af5a76405892d641def691b5f015"
DOTENV_FILE=".env.production"
```

For a local production check, after rebuilding the main image with .env.production included:

```shell
export DOTENV_PRIVATE_KEY_PRODUCTION="$(dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production)"
docker run --rm --env DOTENV_FILE=.env.production --env DOTENV_PRIVATE_KEY_PRODUCTION hello-docker
unset DOTENV_PRIVATE_KEY_PRODUCTION
```

Keep the key out of Dockerfile ARG and ENV instructions, image layers, and git. Return to [Production](https://dotenvx.com/docs/docker.md#production) for the image changes.