Docker overview

ghcr.io/rafay99-epic/envpilot:1 is a single statically linked binary. Copy it into your image, or mount it during a build, and your project's variables and secret files are there.

No Node, no Python, no shell, no libc required. It runs in scratch, distroless, alpine (musl), python:3.12-slim, golang, eclipse-temurin — whatever base image you are already on.

Pick your case#

You want	Read
Secrets available while `docker build` runs	Build time
Secrets in the app when the container starts	Runtime
A Compose stack	Docker Compose
Every flag and exit code	Reference

Sixty-second setup#

Create a key#

In Envpilot, go to Organization → Settings → API Keys and choose the Docker preset. Scope it to the project and environment you are deploying. It carries the variables resource; add files only if you need secret files, which is never granted by default.

Save the key somewhere your deploy process can reach. It starts with envpk_.

Wrap your entrypoint#

❯dockerfile

FROM python:3.12-slim
COPY --from=ghcr.io/rafay99-epic/envpilot:1 /envpilot /usr/local/bin/envpilot
COPY . /app
WORKDIR /app
 
ENTRYPOINT ["envpilot", "exec", "--"]
CMD ["python", "app.py"]

Pass the key at run time#

❯terminal

docker run \
  -v /etc/envpilot/token:/run/secrets/envpilot_token:ro \
  -e ENVPILOT_TOKEN_FILE=/run/secrets/envpilot_token \
  -e ENVPILOT_PROJECT=checkout-api \
  -e ENVPILOT_ENVIRONMENT=production \
  myapp:latest

Your variables are in the environment before python app.py starts, and nothing was written to disk.

How it gets in#

Two mechanisms, depending on when you need the secrets.

At build time the binary is mounted, so it never becomes a layer in your image and neither do the values:

❯dockerfile

RUN --mount=type=secret,id=envpilot_token \
    --mount=from=ghcr.io/rafay99-epic/envpilot:1,source=/envpilot,target=/envpilot \
    ENVPILOT_TOKEN_FILE=/run/secrets/envpilot_token \
    /envpilot exec --project checkout-api --env production -- npm ci

At runtime the binary is copied in, because it has to be present when the container starts:

❯dockerfile

COPY --from=ghcr.io/rafay99-epic/envpilot:1 /envpilot /usr/local/bin/envpilot
ENTRYPOINT ["envpilot", "exec", "--"]

Same binary, same flags, both cases.

The three commands#

Command	Does
`envpilot pull`	Write variables as dotenv text. Stdout unless `--out` is set.
`envpilot files`	Write secret files to their recorded paths at `0600`/`0400`.
`envpilot exec -- <cmd>`	Inject variables into `<cmd>` and run it. Nothing hits disk.

There is no login and no config file. The binary reads its inputs, makes one or two HTTPS calls, and does one thing.

Passing the key#

Variable	Notes
`ENVPILOT_TOKEN_FILE`	Path to a mounted secret. Preferred.
`ENVPILOT_TOKEN`	The key inline.

ENVPILOT_TOKEN_FILE wins when both are set.

Prefer the file. An environment variable is readable through docker inspect and /proc/<pid>/environ by anyone with access to the daemon, while a Compose or BuildKit secret is a tmpfs mount that never touches the image.

There is deliberately no --token flag: a credential on a command line shows up in ps, in shell history, and in build logs.

Pinning#

❯terminal

ghcr.io/rafay99-epic/envpilot:1        # floating major, gets non-breaking updates
ghcr.io/rafay99-epic/envpilot:1.0.0   # exact, you control upgrades

Requirements#

Docker is its own surface, with its own plan feature (docker_image) and its own place on your API keys. It is not a mode of the REST API: your plan can include container delivery without including the public API, and turning one off never touches the other.

Create the key under Organization → Settings → API Keys and pick the Docker preset, or tick Docker under Advanced. A key minted only for the REST API or the GitHub Action will be refused here, on purpose.

Scope the key to the projects and environments it actually serves. One key per service keeps a leaked container credential from reaching everything else.