Docker Container Secrets: capy run as Entrypoint

FROM node:22-slim

WORKDIR /app
COPY package.json bun.lock ./
RUN npm install -g @capysc/cli && bun install --production

COPY . .

# capy run reads SECRETS_BLOB + PROJECT_KEY from the container env,
# decrypts, and spawns your app with plaintext process.env.
ENTRYPOINT ["capy", "run", "--"]
CMD ["node", "server.js"]

docker build -t my-app .

docker run \
  -e SECRETS_BLOB="$SECRETS_BLOB" \
  -e PROJECT_KEY="$PROJECT_KEY" \
  -p 3000:3000 \
  my-app

services:
  app:
    build: .
    environment:
      SECRETS_BLOB: ${SECRETS_BLOB}
      PROJECT_KEY: ${PROJECT_KEY}
    ports:
      - "3000:3000"

apiVersion: v1
kind: Secret
metadata:
  name: capy-deploy
type: Opaque
stringData:
  SECRETS_BLOB: "eyJkZXBsb3lJZCI6..."
  PROJECT_KEY: "a1b2c3..."
---
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: app
          image: registry.example.com/my-app:latest
          envFrom:
            - secretRef:
                name: capy-deploy
          ports:
            - containerPort: 3000