When a container needs a Redis hostname, API key, or other runtime setting, keep the value outside application code. A dotenv file, named .env, holds environment-variable assignments that Docker or Docker Compose can pass to the container. This is especially important for sensitive values that should not be committed with the code. section 6.4.3 section 6.5
A Redis host in .env
Create .env in the Python project root with REDIS_HOST=my-redis-service. Entries use KEY=value; values can also be quoted. Setting REDIS_HOST lets redis-cli ping use the configured host instead of requiring redis-cli -h my-redis-service ping. Add .env to .gitignore so it is not committed; the example project’s ignore file already does this. section 6.4.3
For one container, pass the file with docker run --env-file path/to/.env. For a Compose service, declare env_file: followed by - .env under that service. Other settings, such as PORT=8080, can remain in the service’s environment list. section 6.4.3 section 6.0
Listing 6.13 Using dotenv with Docker Compose
services: ... web: ... env_file: - .env environment: - PORT=8080 volumes: ... ...
See where env_file sits beside environment in a Compose service definition. section 6.4.3
A production deployment can create .env from GitHub Actions secrets, copy it to a virtual machine with SCP, and have Docker Compose read it there. This is a practical deployment path, not a reason to treat dotenv as the preferred production secret store: dedicated secret-management tools are recommended, and protecting the file during transfer requires further work. section 7.3.3 section 6.4.3
Listing 7.11 Using SSH and SCP to add Dotenv secrets to a virtual machine
...
jobs:
deploy:
...
env:
...
SSH_OPTS: '-o StrictHostKeyChecking=no'
REMOTE: 'root@${{ secrets.AKAMAI_INSTANCE_IP_ADDRESS }}'
REMOTE_APP_DIR: '/opt/app'
steps:
...
- name: Create .env file
run: |
echo "MY_SECRET_KEY=${{ secrets.MY_SECRET_KEY }}" >> .env
echo "API_ENDPOINT=${{ secrets.API_ENDPOINT }}" >> .env
- name: Ensure remote directory exists
run: |
ssh $SSH_OPTS $REMOTE mkdir -p $REMOTE_APP_DIR
- name: Copy GitHub Actions .env file to Remote VM
run: |
scp $SSH_OPTS .env $REMOTE:$REMOTE_APP_DIR/.env
Follow the workflow steps that create .env from stored secrets, prepare the remote directory, and copy the file to the virtual machine. section 7.3.3
