- image installs @dotenvx/dotenvx (pinned) and starts via 'dotenvx run -f .env.production --strict -- node server.js' - only DOTENV_PRIVATE_KEY_PRODUCTION is supplied at runtime; without it the container exits(1) (MISSING_PRIVATE_KEY) instead of booting with undecryptable credentials - .env.production copied with --chown=node:node (the source mode is 600) - .dockerignore excludes .env/.env.local/.env.keys so local envs and the private keys never enter the build context
14 lines
187 B
Plaintext
14 lines
187 B
Plaintext
.git
|
|
.opencode
|
|
.vscode
|
|
openspec
|
|
tools/node_modules
|
|
tools/test
|
|
# never bake local env files or the private keys into the image
|
|
.env
|
|
.env.local
|
|
.env.keys
|
|
Dockerfile
|
|
.dockerignore
|
|
README.md
|