Share a private key

Share the encrypted .env file through git and the development private key through your team's approved private channel.

Retrieve the key:

$ dotenvx keypair DOTENV_PRIVATE_KEY

Your teammate puts the value in an ignored .env.keys file:

DOTENV_PRIVATE_KEY="your-shared-private-key"

They can then build the image and use the read-only key mount from Ship.

Keep .env.keys out of git and Docker images. Anyone retaining a copy of the key can still decrypt the file after repository access is removed.