Use cases / Secrets in Docker
Inject secrets into Docker containers without a .env file
Updated September 26, 2026
Start containers and Compose stacks with your secrets in their environment — never in the command line, never on disk, and without the silent --env-file trap.
The usual ways to get secrets into a container all leave a copy somewhere: a .env file next to the compose file, a value in the command line that ps can read, or a baked-in image layer.
One command in front of docker
$ bippass docker run --rm myimage $ bippass docker compose up $ bippass --env staging docker compose up -d
bippass docker decrypts the project’s secrets locally and passes them to the containers by name only: the values travel in the environment of the docker process, never in its arguments and never in a file.
Why bippass run -- docker compose up is not enough
Neither docker run nor Compose forwards your shell environment into a container unless each variable is named. Wrapping docker in bippass run gives the secrets to the docker client, and the containers start without them. bippass docker names every variable for you.
A common trap: docker compose --env-file does not put variables into containers at all. It only feeds ${VAR} interpolation in the compose file, so services start with empty values and nothing reports an error.
Your compose.override.yml keeps working: bippass builds on the configuration Compose itself resolves, then adds the secret names on top.