diff --git a/docs/documentation/getting-started/introduction.mdx b/docs/documentation/getting-started/introduction.mdx index 85ba1e59c..0f54726bb 100644 --- a/docs/documentation/getting-started/introduction.mdx +++ b/docs/documentation/getting-started/introduction.mdx @@ -31,11 +31,11 @@ Start syncing environment variables with [Infisical Cloud](https://app.infisical > Fetch secrets with any programming language on demand - + Inject secrets into Docker containers + Install and run your app start command with Infisical CLI + + + + Feed secrets via `--env-file` flag in docker run command + + + Inject secrets to multiple services using Docker Compose + + + + +The main difference between the "Docker Entrypoint" and "Docker run" approach is where the Infisical CLI is installed. +In most production settings, it's typically inconvenient to have the Infisical CLI installed and executed externally. +As a result, we suggest using the "Docker Entrypoint" method for production purposes. +However, if this limitation doesn't apply to you, select the method that best fits your needs. + \ No newline at end of file diff --git a/docs/integrations/platforms/docker-pass-envs.mdx b/docs/integrations/platforms/docker-pass-envs.mdx new file mode 100644 index 000000000..d6451de71 --- /dev/null +++ b/docs/integrations/platforms/docker-pass-envs.mdx @@ -0,0 +1,48 @@ +--- +title: "Docker Run" +description: "Pass secrets to your docker container at run time" +--- + +This method allows you to feed secrets from Infisical into your container using the `--env-file` flag of `docker run` command. +Rather than giving the flag a file path to your env file, you'll use the Infisical CLI to create a virtual file path. + +For this method to function as expected, you must have a bash shell (for processing substitution) and the [Infisical CLI](../../cli/overview) installed in the environment where you will be running the `docker run` command. + +## 1. Authentication + +If you are already logged in via the CLI you can skip this step. Otherwise, head to your project settings in Infisical Cloud to generate an [Infisical Token](/documentation/platform/token). The service token will allow you to authenticate and fetch secrets from Infisical. +Once you have created a service token with the required permissions, you'll need to feed the token to the CLI. + +#### Pass as flag +You may use the --token flag to set the token + +```bash +infisical export --token=<> +``` + +#### Pass via shell environment variable +The CLI is configured to look for an environment variable named `INFISICAL_TOKEN`. If set, it'll attempt to use it for authentication. + +```bash +export INFISICAL_TOKEN=<> +``` + + + In production scenarios, please to avoid using the `infisical login` command and instead use a [service token](/documentation/platform/token). + + +## 2. Run your docker command with Infisical +Next, use the --env-file flag of the `docker run` command with Infisical CLI to point to your secrets. +Under the hood, this command will fetch secrets from Infisical and serve them as a file to the `--env-file` flag. + +```bash +# In this example, executing a docker run command will initiate an empty Alpine container and display the environment variables passed to it by Infisical. +docker run --rm --env-file <(infisical export --format=dotenv) alpine printenv +``` + +To view all options of the `export` command, click [here](../../cli/commands/export) + + + + When using the --env-file option, Docker does not have the capability to support secrets that span multiple lines. + diff --git a/docs/integrations/platforms/docker.mdx b/docs/integrations/platforms/docker.mdx index 629a81317..848fb6390 100644 --- a/docs/integrations/platforms/docker.mdx +++ b/docs/integrations/platforms/docker.mdx @@ -1,11 +1,10 @@ --- -title: "Docker" +title: "Docker Entrypoint" description: "How to use Infisical to inject environment variables into a Docker container." --- -Prerequisites: - -- Set up and add envars to [Infisical Cloud](https://app.infisical.com) +This approach allows you to inject secrets from Infisical directly into your application. +This is achieved by installing the Infisical CLI into your docker image and modifying your start command to execute with Infisical. ## Add the Infisical CLI to your Dockerfile @@ -48,18 +47,17 @@ CMD ["infisical", "run", "--", "npm", "run", "start"] CMD ["infisical", "run", "--command", "npm run start && ..."] ``` -## Generate an Infisical Token +## Generate an service token -Head to your project settings in Infisical Cloud to generate an [Infisical Token](/documentation/platform/token). +Head to your project settings in the Infisical dashboard to generate an [service token](/documentation/platform/token). +This service token will allow you to authenticate and fetch secrets from Infisical. +Once you have created a service token with the required permissions, you’ll need to feed the token to the CLI installed in your docker container. -## Feed Docker your Infisical Token +## Feed service token to docker container +The last step is to give the Infisical CLI installed in your Docker container access to the service token. This will allow the CLI to fetch and inject the secrets into your application. + +To feed the service token to the container, use the INFISICAL_TOKEN environment variable as shown below. ```bash docker run --env INFISICAL_TOKEN=[token] [DOCKER-IMAGE]... ``` - - - -The Infisical CLI uses the detected `INFISICAL_TOKEN` environment variable to authenticate, retrieve, and inject the environment variables which the token is authorized for. - - diff --git a/docs/mint.json b/docs/mint.json index a749524ef..38f904ef4 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -91,8 +91,8 @@ "documentation/getting-started/introduction", "documentation/getting-started/platform", "documentation/getting-started/sdks", - "documentation/getting-started/docker", - "documentation/getting-started/kubernetes", + "integrations/platforms/kubernetes", + "integrations/platforms/docker-intro", "documentation/getting-started/api" ] }, @@ -187,7 +187,9 @@ { "group": "Docker", "pages": [ + "integrations/platforms/docker-intro", "integrations/platforms/docker", + "integrations/platforms/docker-pass-envs", "integrations/platforms/docker-compose" ] },