Question about SOPS

[TetraLama]

Hey there !

Newbie on this project. First of all, I'm loving this project.

Unfortunately, I run into some issue with SECRETS and AGE key file, I feel like I'm missing something.

I have made a dummy dockform project like this:

.
├── app1
│   ├── docker-compose.yml
│   └── secrets.env
└── dockform.yml

Here is the content of the dockform.yml file:

docker:
  context: default
  identifier: dockform

sops:
  age:
    key_file: ${AGE_KEY_FILE}
    recipients:
      - age1dd6x6rank7eyff7kg3fhs40k8307255d07fpe5nqlu54e8ejwccscw09kx


stacks:
  app1:
    root: app1
    secrets:
      sops:
        - secrets.env


networks:
   app1-net:

Here is the content of the app1/docker-compose.yml

services:
  app1:
    image: ubuntu
    command: tail -f /dev/null
    networks:
      - app1-net

networks:
  app1-net:
    external: true

And here is the decrypted content of the app1/secrets.env

SECRET_KEY=secret

When I run the dockform apply command, everything seems OK:

>dockform apply

│ Context: default
│ Identifier: dockform

Networks
  ↑ app1-net will be created

Stacks
  app1
    ↑ app1 will be created

Plan: 2 to create, 0 to change, and 0 to destroy

│ Dockform will apply the changes listed above.
│ Type yes to confirm.
│
│ ✓

│ Done.

However, when I try to see if there is the SECRET_KEY var inside the container, it's not:

>docker compose -f app1/docker-compose.yml exec app1 bash
root@0df3150805b1:/# env | grep SECRET
root@0df3150805b1:/# env | grep SECRET_KEY

I tried to add the secrets.env inside the app1/docker-compose.yml in a env_file section, without success, it just add the file plaintext

root@3c2abb4909a4:/# env | grep SECRET
SECRET_KEY=ENC[AES256_GCM,data:rPbQGNb3,iv:EHpuOFy4LFR+jxc0/M72TrsE5bNLNTYJ89xqzhXPtFk=,tag:Tr9aGnKq+URV+nSkMmWhRQ==,type:str]

Can you help me figure out what I'm missing?

Thanks a lot !

[gcstr]

Hey, @TetraLama

Thanks for raising this issue! That's clearly a topic that must be improved in the documentation.

When you configure secrets in dockform.yml, the app decrypts them using SOPS and makes them available to Docker Compose as inline environment variables. But Docker Compose requires you to explicitly declare which environment variables each service should receive in your docker-compose.yml file.

Your dockform.yml configuration is good, but you also need to explicitly declare the environment variables in your docker-compose.yml:

services:
  app1:
    image: ubuntu
    command: tail -f /dev/null
    networks:
      - app1-net
    environment:
      - SECRET_KEY  # <- add this
      - SECRET=${SECRET_KEY} # <- or this

networks:
  app1-net:
    external: true

Important

Dockform does not auto-inject secrets for security reasons

Also, do not add the encrypted file directly to env_file in your compose file:

# Don't do this
services:
  app:
    env_file:
      - secrets.env  # This causes Docker to read the encrypted file directly

This causes Docker to read the encrypted SOPS file directly, which is why you saw SECRET_KEY=ENC[AES256_GCM...] in your container.

Tomorrow I'll push changes to the docs, making this part a bit clearer.
Thanks again for the question, and let me know if you get stuck again!