Careeroza

Docker and Environment Secrets

Dockerfile

FROM python:3.12-slim
WORKDIR /app
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
RUN useradd -m appuser
USER appuser
EXPOSE 8000
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

.env
.venv
__pycache__
evals/results
*.ipynb

The second file is .dockerignore: it keeps your .env and local junk out of the image.

Secrets

# .env  (local only, listed in .gitignore and .dockerignore)
ANTHROPIC_API_KEY=sk-ant-...
VOYAGE_API_KEY=pa-...
DATABASE_URL=postgresql://shopease:secret@localhost:5432/shopease

Build and run

Pass secrets at run time, never in the image:

docker build -t shopease-assistant .
docker run -d -p 8000:8000 --env-file .env --name assistant shopease-assistant
curl -s localhost:8000/health

Example output

{"status":"ok"}

Rules

Never commit API keys. If one leaks, revoke it in the console immediately.
Use separate keys for dev, staging and production, with spend limits.
In the cloud, read secrets from a secret manager (GCP Secret Manager, AWS Secrets Manager).