Ditch the .env: Modern Secret Management with Infisical, Docker, and Kubernetes

The Messy Reality of Secrets in Development

I remember my first week at a 20-person startup where the ‘official’ onboarding involved a pinned message in a private Slack channel. That message contained over 50 environment variables. Every time a new engineer joined, they had to copy-paste that massive block of text into a .env file. Predictably, someone eventually committed a production database password to a public GitHub repo. We spent the next 48 hours rotating credentials, auditing logs, and questioning our life choices.

Mastering secret management is a survival skill in modern DevOps. Moving beyond manual .env files isn’t just a security checkbox; it’s about maintaining your sanity. When you’re juggling a dozen microservices across staging and production, the ‘copy-paste’ method doesn’t just scale poorly—it breaks your deployment reliability entirely.

Why Most Secret Workflows Fail

Secret leaks rarely happen because developers are lazy. They happen because the ‘secure’ process is too high-friction. Most teams fall into these three traps:

• Git Sprawl: Secrets leak into Git history because someone forgot to update .gitignore, or they committed a ‘test’ file that was meant to be temporary.
• Configuration Drift: Your staging environment uses an outdated Stripe API key while production is on the new one, but the documentation hasn’t been touched in six months.
• The ‘Vault’ Hurdle: Enterprise tools like HashiCorp Vault offer gold-standard security but come with a brutal learning curve. For a small team, managing a production-grade Vault cluster feels like building a spaceship just to drive to the grocery store.

Comparing the Contenders

I usually evaluate secret managers based on three criteria: setup time, developer experience, and lock-in. Here is how the landscape looks right now:

I’ve recently moved my projects over to Infisical. It hits the sweet spot. You get a sleek UI that non-DevOps teammates can actually navigate, paired with a robust CLI and Kubernetes Operator for the engineering side. It acts as a single source of truth that keeps your secrets in sync across the entire stack.

Setting Up Infisical with Docker

The fastest way to take control of your data is by self-hosting Infisical via Docker Compose. Before you boot it up, you’ll need a few strong, random strings for your ENCRYPTION_KEY and database passwords. I use a Password Generator to create these. I prefer browser-based tools like ToolCraft because the strings are generated locally—they never touch a server, which is non-negotiable for security.

Here is a streamlined docker-compose.yml to get you running:

version: '3.8'
services:
  db:
    image: postgres:15-alpine
    environment:
      POSTGRES_USER: infisical
      POSTGRES_PASSWORD: your_strong_password
      POSTGRES_DB: infisical
    volumes:
      - db_data:/var/lib/postgresql/data

  backend:
    image: infisical/infisical:latest
    depends_on:
      - db
    environment:
      - DB_CONNECTION_URL=postgresql://infisical:your_strong_password@db:5432/infisical
      - ENCRYPTION_KEY=your_32_byte_hex_key
      - AUTH_SECRET=another_random_string
    ports:
      - "8080:8080"

volumes:
  db_data:

Run docker-compose up -d. Your instance will be live at localhost:8080. The onboarding wizard will walk you through creating your first organization and project in under two minutes.

Injecting Secrets Without Local Files

Once your secrets are stored in Infisical, stop downloading them into .env files. Instead, use the Infisical CLI to inject them directly into your application’s process. This ensures that secrets only live in memory, not on your hard drive.

# Install the CLI
curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
sudo apt-get install -y infisical

# Login and initialize
infisical login
infisical init

# Run your app with secrets injected
infisical run -- npm run dev

This command pulls the latest secrets from your instance and provides them as environment variables to Node.js. It’s clean. It’s fast. Most importantly, there are no files left behind for a malicious script to find.

Scaling to Kubernetes

Manually managing Secrets objects in Kubernetes is a recipe for configuration drift. Infisical solves this with a Kubernetes Operator that automatically syncs secrets from your dashboard into your cluster.

First, install the operator via Helm:

helm repo add infisical-helm-charts https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
helm repo update
helm install infisical-operator infisical-helm-charts/infisical-operator

Now, define an InfisicalSecret resource. If I’m working with internal APIs that require specific JSON structures, I’ll use a YAML to JSON converter to verify my manifest formatting before deploying. Here is the standard YAML structure:

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: my-app-secrets
spec:
  hostAPI: https://your-infisical-instance.com/api
  authentication:
    universalAuth:
      secrets:
        clientSecretName: infisical-auth
        clientSecretNamespace: default
  managedSecretReference:
    secretName: app-config-secrets
    secretNamespace: production
  source:
    projectId: your-project-id
    environment: prod

The operator acts as a bridge. If you change a database URL in the Infisical dashboard, the operator detects the change and updates the app-config-secrets in Kubernetes automatically. If you use a tool like Reloader, your pods will even perform a rolling restart to pick up the new values.

Workflow Productivity Tips

When setting up these pipelines, you’ll often need to transform data on the fly. For instance, if you’re storing an SSL certificate or a large config block as a secret, you may need to encode it first. I use a Base64 Encoder to prep these strings for Kubernetes manifests. It’s much faster than running terminal commands every time.

Additionally, always verify your data integrity. If you are uploading binary files or complex config blobs, a quick Hash Generator check ensures the file you uploaded is identical to what your app receives. It’s a small step that prevents massive debugging headaches later.

The Bottom Line

Secret management shouldn’t be a choice between ‘unsecured’ and ‘unusable.’ Infisical provides the enterprise-grade security of a vault with the user experience modern teams expect. Start by cleaning up your local .env workflow with the CLI. Once you’re comfortable, automate your Kubernetes deployments with the Operator. This approach doesn’t just stop leaks; it makes your entire deployment pipeline more resilient and much easier to manage.