Comment by thehamkercat

i use sops

Encrypt: sops encrypt --input-type dotenv --output-type dotenv .env > secrets.enc.env

then rm .env

You can then run your script/dev with: sops exec-env secrets.enc.env 'docker xxxx' (it will ask you for your password, or touch-id to decrypt the secrets)

I like this because this way the .env doesn't sit in the directory at all, and is only passed to your dev environment and stays in it while it's running

Decrypt back to a file (if you ever want that): sops decrypt secrets.enc.env > .env

---

Well ofc, any agent can do docker inspect to get all those env vars, but atleast reading the dotfiles won't do anything

you can also edit the file with: sops --input-type dotenv --output-type dotenv secrets.enc.env