eurailcom/git-crypt repository overview

⁠git-crypt docker image

git-crypt docker image, based on Alpine Linux. Particularly useful as a base image for other image that depend on git-crypt to decrypt secrets from a repository before building or deploying the application.

⁠How to use

To decrypt secrets encrypted with git-crypt, a GPG private key is needed. This key can be passes to the container in two ways:

• environment variables
• volumes If no environment variable is passed, and no volume is mounted, an instruction is printed at the start of the container.

⁠Using environment variables

The secret key can be passes to the container as the GPG_PRIVATE_KEY environment variable. If the private key is in armour format, a newline must be replaced by \n. If the key has a passphrase, this can (optionally) be passes as the GPG_PASSPHRASE environment variable.

Example:

docker run -it --rm -e GPG_PRIVATE_KEY="`cat private.key`" -e GPG_PASSPHRASE="mysecret" eurailcom/git-crypt

⁠Using volumes

Map the .gnupg directory containing the private key of the host machine to /root/.gnugp of the container to make all keys from the host available to the container. If the key has a passphrase, this can (optionally) be passes as the GPG_PASSPHRASE environment variable. Note that the host's gpg-agent.conf file must allow for passphrase preset for this to work. If the host's .gnupg directory contains multiple keys, the GPG_UID environment variable can be used to select the desired key.

Example:

docker run -it --rm -v "~/.gnupg:/home/user/.gnupg" -e GPG_PASSPHRASE="mysecret" -e GPG_UID="[email protected]" eurailcom/git-crypt