---
title: "Docker"
---

Prerequisite: [Infisical Token and How to Generate One](../../getting-started/dashboard/token).

## Step 1: Add CLI to your Dockerfile

<Tabs>
	 <Tab title="Alpine">
		```dockerfile
    	RUN apk add --no-cache bash curl && curl -1sLf \
      'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.alpine.sh' | bash \
      && apk add infisical
    	```

   </Tab>
	 <Tab title="RedHat/CentOs/Amazon-linux">
		```dockerfile
    RUN curl -1sLf \
    'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.rpm.sh' | sh \ 
    && yum install -y infisical
		```
   </Tab>
	 <Tab title="Debian/Ubuntu">
		```dockerfile
    RUN apt-get update && apt-get install -y bash curl && curl -1sLf \
      'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | bash \
      && apt-get update && apt-get install -y infisical
		```
   </Tab>
</Tabs>

## Step 2: Generate Infisical Token

In order for the CLI to authenticate and retrieve your project's secrets without requiring your login credentials, you must [generate an Infisical Token](../../getting-started/dashboard/token); keep it handy.

## Step 3: Set start command of your container

```dockerfile
CMD ["infisical", "--env=[your-project-env-name]", "projectId=[your-project-id]", "run", "---", "<your application start command>"]

# example
CMD ["infisical", "--env=prod", "projectId=62faf98ae0b05e83239b5da41", "run", "---", "npm run start"]
```

Required options:

| Option        | Description                                                                                                 | Default value |
| ------------- | ----------------------------------------------------------------------------------------------------------- | ------------- |
| `--env`       | Used to set the environment that secrets are pulled from. Accepted values: `dev`, `staging`, `test`, `prod` | `dev`         |
| `--projectId` | Used to link a local project to the platform                                                                | `None`        |

## Step 4: Feed Docker your Infisical Token

The CLI looks out for an environment variable called the `INFISICAL_TOKEN` which you can set depending on where you run the CLI. If `INFISICAL_TOKEN` is detected by the CLI, it will authenticate and retrieve the environment variables which the token is authorized for.

```bash
 docker run --env INFISICAL_TOKEN=<the-token-you-got-from-step-2>...
```

Note: `INFISICAL_TOKEN` is the token you generated in step 2.