Remove init and optionally create fallback if DOPPLER_TOKEN supplied …

…at build time

Dockerfile

@@ -21,8 +21,11 @@ EXPOSE 3000
 
 HEALTHCHECK --interval=5s --timeout=5s --retries=3 CMD wget http://localhost:3000/healthz -q -O - > /dev/null 2>&1
 
-# DOPPLER_TOKEN required at runtime for read-only access to specific config
-ENV DOPPLER_TOKEN ${DOPPLER_TOKEN}
+# Pass `DOPPLER_TOKEN` at build time to create an encrypted snapshot for high-availability
+# Only use for local manual builds for learning and testing purposes
+ARG DOPPLER_TOKEN
+ENV DOPPLER_TOKEN $DOPPLER_TOKEN
+RUN [ -z "$DOPPLER_TOKEN" ] && : || doppler run -- echo "Creating encrypted snapshot fallback"
 
 ENTRYPOINT ["doppler", "run", "--"]
 CMD ["npm", "start"]

Makefile

@@ -37,18 +37,17 @@ prod-server-restart: prod-server-down prod-server-up
 ############
 
 docker-build:
-	docker image build -t dopplerhq/yodaspeak:latest .
+	docker image build --build-arg DOPPLER_TOKEN=$(DOPPLER_TOKEN) -t dopplerhq/yodaspeak:latest .
 
 docker-buildx:
-	DOCKER_CLI_EXPERIMENTAL=enabled docker buildx build -t dopplerhq/yodaspeak:latest .
+	DOCKER_CLI_EXPERIMENTAL=enabled docker buildx build --build-arg DOPPLER_TOKEN=$(DOPPLER_TOKEN) -t dopplerhq/yodaspeak:latest .
 
 # Needs `DOPPLER_TOKEN` env var to fetch secrets from Doppler's API
 # Learn more at https://docs.doppler.com/docs/enclave-service-tokens
 # usage: make docker-run-prod DOPPLER_TOKEN=dp.st.XXXX
 docker-run:
 	docker container run \
 		-it \
-		--init \
 		--rm \
 		-d \
 		--name yodaspeak \
@@ -59,7 +58,6 @@ docker-run:
 docker-run-dev:
 	docker container run \
 		-it \
-		--init \
 		--rm \
 		--name yodaspeak \
 		-e "DOPPLER_TOKEN=$(shell doppler configure get token --plain)" \