Fly Machines are long-running containers. Same pattern as Docker: capy run wraps your process, and flyctl secrets set puts SECRETS_BLOB and PROJECT_KEY into the Machine’s env.
Dockerfile
fly.toml
No special Fly config needed - standard http_service on the port your app listens on.
Setting secrets
Fly restarts the Machines automatically after flyctl secrets set. The first boot under the new deploy code calls Capy’s service once, caches the decrypted env for the Machine’s lifetime, and serves traffic.
Deploying
That’s it. The image has capy run as its entrypoint; Fly has the deploy-code secrets; every new Machine decrypts at boot.
Verifying
Shell into a running Machine and inspect its env:
SECRETS_BLOB and PROJECT_KEY are still set too - capy run passes the parent env through to the child.
Revocation
Revoke the deploy token → next Machine boot fails to decrypt, Fly’s health checks flag the bad rollout, traffic stays on the previous Machines. Rotate the project key instead if you need to kill all running Machines’ ability to decrypt. Last modified on June 10, 2026
