Deploy with a private key

For a deployment without Armor Enclaves, encrypt .env.production and choose Local, storing its key in .env.keys:

$ dotenvx encrypt -f .env.production
$ dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production

Set DOTENV_PRIVATE_KEY_PRODUCTION to the returned value in your container platform's runtime secret settings. Set DOTENV_FILE to .env.production.

For a local production check, after rebuilding the main image with .env.production included:

export DOTENV_PRIVATE_KEY_PRODUCTION="$(dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production)"
docker run --rm --env DOTENV_FILE=.env.production --env DOTENV_PRIVATE_KEY_PRODUCTION hello-docker
unset DOTENV_PRIVATE_KEY_PRODUCTION

Keep the key out of Dockerfile ARG and ENV instructions, image layers, and git. Return to Production for the image changes.