SOPS
gunkanmaki.sops
A Docker Compose file for SOPS alone, generated from the catalog and checked by the safety inspector. No account needed.
Command-line editor for encrypted files that encrypts values in YAML, JSON, ENV and INI while leaving keys readable, using age, PGP or a managed key service, so diffs stay meaningful in Git.
SOPS encrypts the values in a structured configuration file and leaves its keys in plain text, so changing one secret produces a one-line diff rather than an opaque blob. Each file's data key is wrapped by one or more master keys — age, PGP or a cloud key service — which lets several people and systems decrypt the same file without sharing one private key. A creation-rules file maps paths to recipients, so which key protects which file is itself version-controlled. It is a tool invoked to encrypt, decrypt or edit a file, not a service that runs continuously.
You know it worked when
- The tool reports its version when run in the container.
- A file encrypted with a configured key shows readable keys and encrypted values.
- Decrypting that file returns the original content unchanged.
- A second recipient key decrypts the same file independently.
- A file edited through the tool re-encrypts on save without altering unrelated values.
Known sharp edges
- It is a command-line tool rather than a long-running service, so a container started without a command exits immediately, which reads as a crash loop.
- Master keys must be available wherever decryption happens; a file encrypted with a key held on one machine cannot be read anywhere else.
- Only values are encrypted — keys, structure and comments stay in plain text, so a secret placed in a key name is exposed.
- The Mozilla namespace is no longer where the project is maintained, so an image pulled from it may be stale.