I wanted one clean deployment path for local testing and real cluster rollout, so I packaged the same app for both Docker Compose and Kubernetes (Helm).

This post is the exact runbook I now use for darkedges-entraid-tokenexchange .

Why this setup works

This app is a Next.js token-exchange broker with:

OIDC sign-in (single or multiple providers)

Redis-backed sessions

Entra token exchange support

Optional Vault integration

The key idea is simple: run the same container image everywhere, then swap environment values per environment.

Local path: Docker Compose

The repository already includes a ready-to-run docker-compose.yaml with:

app on port 3000

vault

vault-init and vault-data-init

Step 1: Create your environment file

cp .env.example .env

Enter fullscreen mode

Exit fullscreen mode

Populate at minimum:

NEXTAUTH_SECRET=<random-32-byte-secret> NEXTAUTH_URL=http://localhost:3000

ENTRAID_TENANT_ID=<tenant-guid> ENTRAID_CLIENT_ID=<app-client-id> ENTRAID_CLIENT_SECRET=<app-client-secret>…