Docker workflow

This route runs the Fractum CLI in a container. Build or import the image before an air-gapped operation. The --network=none flag is a Docker runtime option: include it when your procedure requires Docker-enforced network isolation.

1. Prepare a working directory

Clone a known release, create folders for the input file and share archives, then place a disposable test file in data/.

git clone https://github.com/katvio/fractum.git
cd fractum
git checkout <verified-release-tag>
mkdir -p data shares
cp /path/to/test-file.txt data/

2. Build the image

docker build -t fractum-secure .

The image runs as a non-root user and exposes /data and /app/shares as working locations. A first build can need dependencies to be available through the repository's package bundle or the build environment, so do this before disconnecting a machine from the network. Use the release tag and verification material published with the version you intend to run; do not assume an unpublished tag exists.

3. Encrypt a test file

Choose K shares needed for recovery and N shares to create. This example needs any 3 of 5 shares.

docker run --rm -it \
  --network=none \
  -v "$(pwd)/data:/data" \
  -v "$(pwd)/shares:/app/shares" \
  fractum-secure encrypt /data/test-file.txt \
  --threshold 3 \
  --shares 5 \
  --label "recovery-test" \
  --verbose

After a successful run, data/test-file.txt.enc is the encrypted file and shares/ contains one ZIP archive per share. Fractum does not delete the original input file; decide separately how it should be retained or disposed of.

4. Prove recovery immediately

Keep the encrypted file in data/, leave at least three generated archives in shares/, then run:

docker run --rm -it \
  --network=none \
  -v "$(pwd)/data:/data" \
  -v "$(pwd)/shares:/app/shares" \
  fractum-secure decrypt /data/test-file.txt.enc \
  --shares-dir /app/shares \
  --verbose

The command writes data/test-file.txt. It stops rather than overwriting an existing output file, so rename or remove an earlier test output before repeating the same recovery command.

Docker options in this workflow

Option	Why it is used
`--rm`	Removes the container after the command exits.
`-it`	Keeps the command interactive, including manual share entry when used.
`--network=none`	Disables network access for that container run.
`-v "$(pwd)/data:/data"`	Makes the input and encrypted file available to the container.
`-v "$(pwd)/shares:/app/shares"`	Makes generated share archives available outside the container.

For a detailed explanation of share output and threshold choice, continue with encrypting files. For the recovery path, see decrypting files.