Docker workflow

This route runs the Fractum CLI in a container. Build or import the image before an air-gapped operation. The --network=none flag is a Docker runtime option: include it when your procedure requires Docker-enforced network isolation.

1. Prepare a working directory

Clone a known release, create folders for the input file and share archives, then place a disposable test file in data/.

git clone https://github.com/katvio/fractum.git
cd fractum
git checkout v1.4.2
mkdir -p data shares
cp /path/to/test-file.txt data/

2. Build the image

docker build -t fractum-secure .

The image runs as a non-root user and exposes /data and /app/shares as working locations. A first build can need dependencies to be available through the repository's package bundle or the build environment, so do this before disconnecting a machine from the network. These commands use v1.4.2, the current release. To run another version, check out its tag and use the verification material published with it.

3. Encrypt a test file

Choose K shares needed for recovery and N shares to create. This example needs any 3 of 5 shares.

docker run --rm -it \
  --network=none \
  -v "$(pwd)/data:/data" \
  -v "$(pwd)/shares:/app/shares" \
  fractum-secure encrypt /data/test-file.txt \
  --threshold 3 \
  --shares 5 \
  --label "recovery-test" \
  --verbose

After a successful run, data/test-file.txt.enc is the encrypted file and shares/ contains one ZIP archive per share. Fractum does not delete the original input file; decide separately how it should be retained or disposed of. If shares/ already holds a set from an earlier run, the new set is written to shares/set-2/, still inside the mounted directory.

4. Prove recovery immediately

Keep the encrypted file in data/, leave at least three generated archives in shares/, then run:

docker run --rm -it \
  --network=none \
  -v "$(pwd)/data:/data" \
  -v "$(pwd)/shares:/app/shares" \
  fractum-secure decrypt /data/test-file.txt.enc \
  --shares-dir /app/shares \
  --verbose

The command writes data/test-file.txt. It stops rather than overwriting an existing output file, so rename or remove an earlier test output before repeating the same recovery command.

Docker options in this workflow

For a detailed explanation of share output and threshold choice, continue with encrypting files. For the recovery path, see decrypting files.