SECRET_KEY_BASE not injected into container on macOS, causing crash loop

[jturan]

Environment:

• Apple M2 Air, macOS 15.7.3 (Sequoia)
• Docker Desktop 29.2.1 (linux/aarch64, kernel 6.12.76-linuxkit)
• once v0.1.1
• Image: basecamp/once-campfire

Description:
After installing once and running basecamp/once-campfire, the container enters a crash loop because SECRET_KEY_BASE is not being injected as an environment variable. Per the README, this value should be "generated at installation time, and kept for the life of the application", but it is not present in the container's environment. The same bug appears to occur in both Writebook and Fizzy as well.

Container Logs:

9:C 16 Mar 2026 20:59:59.840 * oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo

9:C 16 Mar 2026 20:59:59.840 * Redis version=8.0.2, bits=64, commit=00000000, modified=0, pid=9, just started

9:C 16 Mar 2026 20:59:59.840 * Configuration loaded

9:M 16 Mar 2026 20:59:59.841 * monotonic clock: POSIX clock_gettime

9:M 16 Mar 2026 20:59:59.843 * Running mode=standalone, port=6379.

9:M 16 Mar 2026 20:59:59.844 * Server initialized

9:M 16 Mar 2026 20:59:59.844 * Ready to accept connections tcp

{"time":"2026-03-16T21:00:00.231411125Z","level":"INFO","msg":"Server started","http":":80"}

resque-pool-manager[rails][11]: Resque Pool running in production environment

bin/rails aborted!

ArgumentError: Missing `secret_key_base` for 'production' environment, set this string with `bin/rails credentials:edit` (ArgumentError)


          raise ArgumentError, "Missing `secret_key_base` for '#{Rails.env}' environment, set this string with `bin/rails credentials:edit`"

                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

/rails/config/environment.rb:5:in '<top (required)>'

Tasks: TOP => db:prepare => db:load_config => environment

(See full trace by running task with --trace)

{"time":"2026-03-16T21:00:01.855852917Z","level":"INFO","msg":"Server stopping"}

{"time":"2026-03-16T21:00:01.857500292Z","level":"INFO","msg":"Server stopped"}

9:signal-handler (1773694801) Received SIGTERM scheduling shutdown...

9:signal-handler (1773694801) Received SIGTERM scheduling shutdown...

9:M 16 Mar 2026 21:00:01.870 * User requested shutdown...

9:M 16 Mar 2026 21:00:01.870 # Redis is now ready to exit, bye bye...

The container starts, Redis initializes successfully, but the Rails app aborts during db:prepare because SECRET_KEY_BASE is absent. The container then shuts down and restarts repeatedly.

Steps to reproduce:

1. Install once on macOS via curl https://get.once.com | sh
2. Install basecamp/once-campfire through the once UI
3. Observe container crash loop in docker logs

[jturan]

After further investigation, I can confirm the root cause and provide a more detailed reproduction path.

What's actually happening:

The container crashes immediately on startup because SECRET_KEY_BASE is never injected into its environment. This causes a cascade of two errors depending on the install attempt:

• First attempt: ArgumentError: Missing secret_key_base for 'production' environment
• Subsequent attempts: deploy failed: registering with proxy: exec failed with exit code 1: Error: host settings conflict with another service

The second error is a red herring, and it's caused by the failed deploy partially registering with kamal-proxy before the health check fails, leaving a stale entry that blocks all future attempts. The actual bug is the missing env var.

Confirmation:

Running the container manually with SECRET_KEY_BASE explicitly set boots successfully every time:

docker run --rm -d \
  --publish 8080:80 \
  --volume campfire:/rails/storage \
  --env SECRET_KEY_BASE=$(openssl rand -hex 64) \
  --env DISABLE_SSL=true \
  ghcr.io/basecamp/once-campfire

Rails boots cleanly with Puma, all 6 workers come up, no errors.

Environment:

• macOS 15.7.3 (Sequoia), Apple Silicon (arm64)
• Docker Desktop 29.2.1 (linux/aarch64, kernel 6.12.76-linuxkit)
• once v0.1.2
• Docker socket symlinked: /var/run/docker.sock → ~/.docker/run/docker.sock (required workaround for macOS)

Additional context:

The Docker socket on macOS Desktop lives at ~/.docker/run/docker.sock rather than the standard /var/run/docker.sock, requiring a manual symlink to get once working at all. It's possible this non-standard socket path or another macOS Docker Desktop quirk is interfering with how once sets up the container environment, specifically the generation and injection of SECRET_KEY_BASE at install time.

[ponny]

Got the same thing on Ubuntu 24.04.

A hacky workaround for this was to run SECRET_KEY_BASE=$(openssl rand -hex 64) once which got me through the install of Fizzy.