capy run has you covered. It decrypts .env in memory and spawns your command with the plaintext values injected as environment variables. It works with anything that reads env vars - PHP, Elixir, Java, .NET, Deno, Bun, static binaries, shell scripts.
The pattern
- Reads the local
.envfile. - Decrypts every
capy:…snippet using your project key. - Spawns the child process with the decrypted values in its environment.
- Forwards signals (
SIGINT,SIGTERM,SIGHUP) and exits with the child’s exit code.
Examples
In containers
capy run works as the entrypoint of a Docker container as long as SECRETS_BLOB and PROJECT_KEY are both set in the container’s environment - that pair is what capy deploy mints for you. In that mode capy run decrypts the blob instead of reading .env, so it needs to reach the Capy service once at startup. Set only one of the two and capy run refuses to guess which mode you meant and exits 1. See Deploying for how to inject them.
What’s next
Running your app
Signals, exit codes, and env precedence in detail.