SOPS
gunkanmaki.sops
Command-line editor for encrypted files that encrypts values in YAML, JSON, ENV and INI while leaving keys readable, using age, PGP or a managed key service, so diffs stay meaningful in Git.
A Docker Compose file for SOPS alone, generated from the catalog and checked by the safety inspector. Sign in and use Kitchen Credits to activate it.
Uses the Medusa cart and payment-session path. This test control does not create an order or capture payment.
SOPS encrypts the values in a structured configuration file and leaves its keys in plain text, so changing one secret produces a one-line diff rather than an opaque blob. Each file's data key is wrapped by one or more master keys — age, PGP or a cloud key service — which lets several people and systems decrypt the same file without sharing one private key. A creation-rules file maps paths to recipients, so which key protects which file is itself version-controlled. It is a tool invoked to encrypt, decrypt or edit a file, not a service that runs continuously.
You know it worked when
- The tool reports its version when run in the container.
- A file encrypted with a configured key shows readable keys and encrypted values.
- Decrypting that file returns the original content unchanged.
- A second recipient key decrypts the same file independently.
- A file edited through the tool re-encrypts on save without altering unrelated values.
Known sharp edges
- It is a command-line tool rather than a long-running service, so a container started without a command exits immediately, which reads as a crash loop.
- Master keys must be available wherever decryption happens; a file encrypted with a key held on one machine cannot be read anywhere else.
- Only values are encrypted — keys, structure and comments stay in plain text, so a secret placed in a key name is exposed.
- The Mozilla namespace is no longer where the project is maintained, so an image pulled from it may be stale.