doppler-run

execute commands with injected secrets

TLDR

Run command with injected secrets

$ doppler run -- [node app.js]

Run with specific config

$ doppler run --config [dev] -- [command]

Run with specific project

$ doppler run --project [myapp] -- [command]

Passthrough to shell

$ doppler run -- sh -c "[echo \$SECRET_KEY]"

Run with fallback file

$ doppler run --fallback [.env.backup] -- [command]

Mount secrets as a file

$ doppler run --mount [secrets.env] -- [command]

Transform secret names for .NET

$ doppler run --name-transformer dotnet-env -- [dotnet run]

SYNOPSIS

doppler run [options] -- command [args]

doppler run executes a command with secrets from Doppler injected as environment variables. This enables applications to access secrets without code changes or local configuration files.Secrets are fetched from the Doppler API and made available only to the executed process. The double-dash separates doppler options from the command to run.Fallback files provide resilience when Doppler is unreachable, while preserve-env prevents overwriting existing environment variables.

PARAMETERS

-- COMMAND

Command to run with injected secrets.

--config NAME

Configuration environment to use.

--project NAME

Project name.

--fallback FILE

Fallback file if Doppler unavailable.

--no-fallback

Disable fallback behavior.

--preserve-env

Preserve existing environment variables. Accepts a comma-separated list of specific secrets (e.g. --preserve-env="FOO,BAR") or "true" for all.

--mount PATH

Write secrets to an ephemeral file instead of injecting into the environment. Format auto-detected from file extension.

--mount-format FORMAT

File format for mounted secrets (e.g. json, env).

--name-transformer TRANSFORMER

Transform secret names from UPPERSNAKECASE (e.g. dotnet-env, tf-var, lower-camel, lower-snake).

--command CMD

Command to execute (alternative to using -- separator).

--clean-exit

Exit with a 0 status code when the command is interrupted (SIGINT).

--help

Display help information.

CAVEATS

Requires authenticated doppler CLI. Network latency affects startup time. Secrets visible in process environment. Child processes inherit secrets.

HISTORY

doppler run is the primary command for secrets injection in the Doppler CLI, implementing the zero-configuration secrets access that Doppler was designed to provide.