Platforms
Envlet on Docker
Pass one variable into the container and start through envlet run. No .env file baked into the image.
ENVLET_TOKENset with docker
Set up
Three steps. The host keeps one secret and everything else arrives at boot.
- 01
Create a token
Add Docker under Access and create a token for the environment it deploys.
ci/dockerciIts own token, separate from your login.- token
- envlet_•••••••• shown once
- opens
- one project, one environment
- expires
- always
- 02
Set one secret
Pass ENVLET_TOKEN with -e, or from your orchestrator's secret store.
Set the tokendocker run -e ENVLET_TOKEN=envlet_... acme/api - 03
Start through Envlet
Install the CLI in the image and make envlet run the CMD.
DockerfileRUN npm install -g @envlet/cli CMD ["envlet", "run", "--", "node", "server.js"]
What the host keeps
One secret in Docker. Rotate everything else in Envlet without touching the host.
Docker / production / environment variables
| ENVLET_TOKEN | envlet_•••••••• | the only secret the host keeps |
| DATABASE_URL | •••••••• | moved to Envlet |
| STRIPE_KEY | •••••••• | moved to Envlet |
| SENTRY_DSN | •••••••• | moved to Envlet |
Questions
Will my app start if Envlet is down?
No. It retries for a few seconds, then fails so you notice. It never starts with half an environment.
Do I still need Docker's own secret store?
Only for ENVLET_TOKEN. Everything else lives in Envlet, so you rotate in one place.