Credential Examples

🚀Credential Examples

Stable

Set up GitHub or GitLab without copying secrets into the project.

Commandcusty configure credentials

📦Category

Configuration

🚀Quick Command

custy configure credentials COMMAND [OPTIONS]

---

File-backed GitHub token

Terminal

bash

custy configure credentials set --provider github --source file

The hidden prompt stores the token under the external credential root. Mount that directory read-only into the container:

Create the file from Windows CMD through Docker

The credential mount must be writable while set creates or replaces the external file:

CMD

bash

docker run --rm -it -v "%cd%:/workspace" -v "%LOCALAPPDATA%Custycredentials:/run/secrets/custy" -w /workspace custy-prod:latest --no-banner configure credentials set --provider github

The resulting host file is %LOCALAPPDATA%\Custy\credentials\github.token. Inside the running container, the same file is /run/secrets/custy/github.token.

After setup, mount the directory read-only for status, testing, and push:

PowerShell

bash

docker run --rm -it -v "${PWD}:/workspace" -v "$env:LOCALAPPDATA/Custy/credentials:/run/secrets/custy:ro" -w /workspace custy-prod:latest push

CMD

bash

docker run --rm -it -v "%cd%:/workspace" -v "%LOCALAPPDATA%Custycredentials:/run/secrets/custy:ro" -w /workspace custy-prod:latest push

Inspect the mounted source from Windows CMD

CMD

bash

docker run --rm -it -v "%cd%:/workspace" -v "%LOCALAPPDATA%Custycredentials:/run/secrets/custy:ro" -w /workspace custy-prod:latest --no-banner configure credentials status

docker run --rm -it -v "%cd%:/workspace" -v "%LOCALAPPDATA%Custycredentials:/run/secrets/custy:ro" -w /workspace custy-prod:latest --no-banner configure credentials test --remote origin

Token file: valid is sufficient. Environment: missing is expected when the file source is used and CUSTY_GITHUB_TOKEN was not supplied.

Environment-backed GitLab token

Terminal

bash

custy configure credentials set --provider gitlab --source environment --token-env CUSTY_GITLAB_TOKEN

docker run --rm -it -e CUSTY_GITLAB_TOKEN -v "${PWD}:/workspace" -w /workspace custy-prod:latest push

Set the variable in the calling shell or secret-aware CI/Docker runtime. Avoid literal token values in committed Compose files or reusable shell history.

Inspect and test

Terminal

bash

custy configure credentials status
custy configure credentials test --remote origin

Use the Make helpers

From the Custy source checkout, the d-, c-, and r-custy- target families can create, inspect, test, and use the same external credential directory:

Local Docker image

bash

# Setup uses a writable mount
make d-credentials-set-github
make d-credentials-set-gitlab

# Inspection and access testing use a read-only mount

make d-credentials-status
make d-credentials-test CUSTY_CREDENTIALS_REMOTE=origin

# Runtime mounting is explicit and read-only

make d-run-push CUSTY_CREDENTIALS_MOUNT=true

Equivalent Compose and published-image targets are available as c-credentials-* / c-run-push and r-custy-credentials-* / r-custy-run-push.

Setting	Result
CUSTY_CREDENTIALS_MOUNT=false	Default. Do not mount the external files; native Git, SSH, or an interactive username/PAT prompt remains responsible for authentication.
CUSTY_CREDENTIALS_MOUNT=true	Mount the external directory read-only for a runtime command such as d-run-push.
make d-credentials-set-github	Mount the directory writable only while Custy creates or replaces github.token.
make d-credentials-status or make d-credentials-test	Mount the directory read-only without displaying a token value.

On Windows, CUSTY_CREDENTIALS_HOST_DIR defaults to %LOCALAPPDATA%/Custy/credentials. On Linux and macOS it uses $XDG_DATA_HOME/custy/credentials, or $HOME/.local/share/custy/credentials when XDG_DATA_HOME is unset. Override the location explicitly when required:

Terminal

bash

make d-run-push CUSTY_CREDENTIALS_MOUNT=true CUSTY_CREDENTIALS_HOST_DIR=/approved/secret/directory

The token itself is never passed as a Make variable or written into a Makefile.

Disable or delete

Terminal

bash

# Disable but preserve the external file
custy configure credentials remove --provider github

# Disable and explicitly delete the external file

custy configure credentials remove --provider github --delete-file

ℹ️Interactive prompting is still available

If no managed token is available and an interactive terminal is permitted, Git may still ask for username and password/PAT. Custy releases the terminal before that prompt. For HTTPS, enter a PAT when Git asks for Password; account password authentication is not the intended input.

Manual Docker fallback

CMD

bash

docker run --rm -it -v "%cd%:/workspace" -w /workspace custy-prod:latest --no-banner push

This intentionally omits the credential mount and token environment variable. Git may ask for a username and PAT for each HTTPS provider. The values are not persisted by a disposable --rm container.