kms/docs/integrations/platforms/docker.mdx

---
title: "Docker Entrypoint"
description: "Learn how to use KMS to inject environment variables into a Docker container."
---

This approach allows you to inject secrets from KMS directly into your application.
This is achieved by installing the KMS CLI into your docker image and modifying your start command to execute with KMS.

## Install the KMS CLI to your Dockerfile

To install the CLI, follow the instructions for your chosen distribution [here](/cli/overview).

####
<Tip>
  We recommend you to set the version of the CLI to a specific version. This will help keep your CLI version consistent across reinstalls. [View versions](https://github.com/hanzoai/kms/releases)
</Tip>

## Modify the start command in your Dockerfile

Starting your service with the KMS CLI pulls your secrets from KMS and injects them into your service.

<Tabs>
  <Tab title="Machine Identity (Recommended)">
    ```dockerfile
  CMD ["kms", "run", "--projectId", "<your-project-id>", "--", "[your service start command]"]

# example with single single command

CMD ["kms", "run", "--projectId", "<your-project-id>", "--", "npm", "run", "start"]

# example with multiple commands

CMD ["kms", "run", "--projectId", "<your-project-id>", "--command", "npm run start && ..."]

````

<Steps>
  <Step title="Generate a machine identity">
    Generate a machine identity for your project by following the steps in the [Machine Identity](/documentation/platform/identities/machine-identities) guide. The machine identity will allow you to authenticate and fetch secrets from KMS.
  </Step>
  <Step title="Obtain an access token for the machine identity">
    Obtain an access token for the machine identity by running the following command:
    ```bash
    export KMS_TOKEN=$(hanzo-kms login --method=universal-auth --client-id=<your-client-id> --client-secret=<your-client-secret> --plain --silent)
    ```

    <Info>
     Please note that the access token has a limited lifespan. The `kms token renew` command can be used to renew the token if needed.
    </Info>
  </Step>
  <Step title="Feed the access token to the docker container">
    The last step is to give the KMS CLI installed in your Docker container access to the access token. This will allow the CLI to fetch and inject the secrets into your application.

    To feed the access token to the container, use the KMS_TOKEN environment variable as shown below.

    ```bash
    docker run --env KMS_TOKEN=$KMS_TOKEN [DOCKER-IMAGE]...
    ```
  </Step>
</Steps>

### Using a Starting Script

The drawback of the previous method is that you would have to generate the `KMS_TOKEN` manually. To automate this process, you can use a shell script as your starting command.

<Steps>
  <Step title="Generate a Machine Identity">
    Create a machine identity for your project by following the steps in the [Machine Identity](/documentation/platform/identities/machine-identities) guide. This identity will enable authentication and secret retrieval from KMS.
  </Step>

  <Step title="Create the Shell Script">
    Create a shell script to obtain an access token for the machine identity:

    ```bash script.sh
    #!/bin/sh
    export KMS_TOKEN=$(hanzo-kms login --method=universal-auth --client-id=$KMS_MACHINE_CLIENT_ID --client-secret=$KMS_MACHINE_CLIENT_SECRET --plain --silent)
    exec hanzo-kms run --token $KMS_TOKEN --projectId $PROJECT_ID --env $KMS_SECRET_ENV --domain $KMS_API_URL -- <starting script>
    ```

    > **Note:** The access token has a limited lifespan. Use the [kms token renew](/cli/commands/token) CLI command to renew it when necessary.
		<Warning>
		Caution: Implementing this directly in your Dockerfile presents two key issues:

		1. Lack of persistence: Variables set in one build step are not automatically carried over to subsequent steps, complicating the process.
		2. Security risk: It exposes sensitive credentials inside your container, potentially allowing anyone with container access to retrieve them.
		</Warning>
  </Step>

  <Step title="Update Your Dockerfile">
    Grant the KMS CLI access to the access token, inside your Docker container. This allows the CLI to fetch and inject secrets into your application.

    Add the following line to your Dockerfile:

    ```dockerfile
    CMD ["./script.sh"]
    ```
  </Step>
</Steps>

</Tab>
<Tab title="Service Token (Deprecated)">
```dockerfile
CMD ["kms", "run", "--", "[your service start command]"]

# example with single single command
CMD ["kms", "run", "--", "npm", "run", "start"]

# example with multiple commands
CMD ["kms", "run", "--command", "npm run start && ..."]
````

  <Steps>
    <Step title="Generate a service token">
      Head to your project settings in the KMS dashboard to generate an [service token](/documentation/platform/token). 
      This service token will allow you to authenticate and fetch secrets from KMS. 
      Once you have created a service token with the required permissions, you’ll need to feed the token to the CLI installed in your docker container.
    </Step>
    <Step title="Feed service token to docker container">
      The last step is to give the KMS CLI installed in your Docker container access to the service token. This will allow the CLI to fetch and inject the secrets into your application.

      To feed the service token to the container, use the KMS_TOKEN environment variable as shown below.

      ```bash
      docker run --env KMS_TOKEN=[token] [DOCKER-IMAGE]...
      ```
    </Step>

  </Steps>
  </Tab>
</Tabs>