Docker Container Secrets: capy run as Entrypoint

FROM node:22-slim

WORKDIR /app
COPY package.json package-lock.json ./
RUN npm install -g @capysc/cli && npm ci --omit=dev

COPY . .

# capy run reads SECRETS_BLOB + PROJECT_KEY from the container env, fetches the
# service key from Capy, decrypts, and spawns your app with the plaintext
# values in process.env.
ENTRYPOINT ["capy", "run", "--"]
CMD ["node", "server.js"]

docker build -t my-app .

docker run \
  -e SECRETS_BLOB="$SECRETS_BLOB" \
  -e PROJECT_KEY="$PROJECT_KEY" \
  -p 3000:3000 \
  my-app

services:
  app:
    build: .
    environment:
      SECRETS_BLOB: ${SECRETS_BLOB}
      PROJECT_KEY: ${PROJECT_KEY}
    ports:
      - "3000:3000"

apiVersion: v1
kind: Secret
metadata:
  name: capy-deploy
type: Opaque
stringData:
  # Both values come from capy deploy.
  SECRETS_BLOB: "<base64 blob>"
  PROJECT_KEY: "<64-character hex key>"
---
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: app
          image: registry.example.com/my-app:latest
          envFrom:
            - secretRef:
                name: capy-deploy
          ports:
            - containerPort: 3000