- image installs @dotenvx/dotenvx (pinned) and starts via
'dotenvx run -f .env.production --strict -- node server.js'
- only DOTENV_PRIVATE_KEY_PRODUCTION is supplied at runtime; without it the
container exits(1) (MISSING_PRIVATE_KEY) instead of booting with
undecryptable credentials
- .env.production copied with --chown=node:node (the source mode is 600)
- .dockerignore excludes .env/.env.local/.env.keys so local envs and the
private keys never enter the build context