# How to pass service token in Dockerfile

**URL:** <https://community.doppler.com/t/how-to-pass-service-token-in-dockerfile/176>\
**Category:** Need Help\
**Created:** [April 8, 2021, 11:56am UTC](https://community.doppler.com/t/how-to-pass-service-token-in-dockerfile/176 "2021-04-08T11:56:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elton](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/elton/32/117_2.png) [@Elton](https://community.doppler.com/u/Elton)\
**Post date:** [April 8, 2021, 11:56am UTC](https://community.doppler.com/t/how-to-pass-service-token-in-dockerfile/176/1 "2021-04-08T11:56:46Z")

</div>

Hello Guys I need help with the pass service token doppler in my docker file, I use command  
`docker build --build-arg "DOPPLER_TOKEN=$DOPPLER_TOKEN" .` In my github action but after push image to aws my app is not running I received error message: Doppler Error: you must provide a token

`FROM python:3.8.5-alpine`

`WORKDIR /code`

`COPY . /code/`

`RUN python -m pip install --upgrade pip && pip install -r requirements.txt`

`RUN (curl -Ls --tlsv1.2 --proto "=https" --retry 3 https://cli.doppler.com/install.sh || wget -t 3 -qO- https://cli.doppler.com/install.sh) | sh`

`ARG DOPPLER_TOKEN`

`CMD ["doppler", "run", "--", "python3", "send_doc.py"]`

---

<div class="post-metadata">

**Author:** ![ryan-blunden](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/ryan-blunden/32/9_2.png) [@ryan-blunden](https://community.doppler.com/u/ryan-blunden)\
**Post date:** [April 8, 2021, 2:16pm UTC](https://community.doppler.com/t/how-to-pass-service-token-in-dockerfile/176/2 "2021-04-08T14:16:47Z")

</div>

Hey @Elton and welcome to the Doppler community!

Your solution is really close! Instead of `DOPPLER_TOKEN` being a build `ARG`, I’d change this to an environment variable that should be supplied as part of your deployment process to AWS.

A common workflow with our customers is storing the service token value in a GitHub Secret, then a cloud-init (user data) script embeds that value as a `DOPPLER_TOKEN` environment variable that is then passed to the container to be run.

Something like:

```auto
export DOPPLER_TOKEN="${{ secrets.DOPPLER_TOKEN }}"
docker run -d -e DOPPLER_TOKEN=$DOPPLER_TOKEN your-app

```

---

<div class="post-metadata">

**Author:** ![Elton](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/elton/32/117_2.png) [@Elton](https://community.doppler.com/u/Elton)\
**Post date:** [April 8, 2021, 2:48pm UTC](https://community.doppler.com/t/how-to-pass-service-token-in-dockerfile/176/3 "2021-04-08T14:48:55Z")

</div>

In this case I will run command in aws `docker run -d -e DOPPLER_TOKEN=$DOPPLER_TOKEN your-app` ? My process in Github actions

```
- name: Build, tag, and push image to Amazon ECR
  id: build-image
  env:
    ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
    ECR_REPOSITORY: 1234566.dkr.ecr.us-east-1.amazonaws.com/pythonnetwork
    IMAGE_TAG: ${{ github.sha }}
  run: |
    docker build --build-arg=DOPPLER_TOKEN=${{ secrets.DOPPLER_TOKEN }} -t python-network .
    docker tag python-network:latest $ECR_REPOSITORY:latest
    docker push $ECR_REPOSITORY:latest

```

I think to create my docker file in this model.

`FROM python:3.8.5-alpine`

`WORKDIR /code`  
`COPY . /code/`

`RUN python -m pip install --upgrade pip && pip install -r requirements.txt`

`RUN (curl -Ls https://cli.doppler.com/install.sh || wget -qO- https://cli.doppler.com/install.sh) | sh`

`ARG DOPPLER_TOKEN`

`ENV DOPPLER_TOKEN ${DOPPLER_TOKEN}`

`CMD ["doppler", "run", "--", "python3", "send_doc.py"]`

My application is working with the code above Thanks @ryan-blunden

---

<div class="post-metadata">

**Author:** ![ryan-blunden](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/ryan-blunden/32/9_2.png) [@ryan-blunden](https://community.doppler.com/u/ryan-blunden)\
**Post date:** [April 9, 2021, 6:47am UTC](https://community.doppler.com/t/how-to-pass-service-token-in-dockerfile/176/4 "2021-04-09T06:47:47Z")

</div>

Glad you got it working @Elton!

Just be aware that embedding the service token in the image has the following implications:

- Anyone that can pull the image can access the secrets linked to the service token
- The image is now config specific as the secrets are tied to the image build

If this image is only for a single environment and you absolutely trust everyone that will ever have access to the image, then this is ok, but my recommendation would be to only supply the `DOPPLER_TOKEN` environment variable when running the container and not at build time.

Let me know if I can help you further.

---

<div class="post-metadata">

**Author:** ![Elton](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/elton/32/117_2.png) [@Elton](https://community.doppler.com/u/Elton)\
**Post date:** [April 9, 2021, 3:18pm UTC](https://community.doppler.com/t/how-to-pass-service-token-in-dockerfile/176/5 "2021-04-09T15:18:27Z")

</div>

Hello @ryan-blunden I use the image for a personal project, thank you for the tips, I will use it in the next steps.