diff --git a/services/git-bridge/.dockerignore b/services/git-bridge/.dockerignore
index e49947d0fd..acfeee7413 100644
--- a/services/git-bridge/.dockerignore
+++ b/services/git-bridge/.dockerignore
@@ -1,6 +1,9 @@
 *
+!start.sh
+!/conf
 !/lib
 !/src/main
 !/pom.xml
 !/Makefile
 !/LICENSE
+!/vendor
diff --git a/services/git-bridge/.gitignore b/services/git-bridge/.gitignore
index 43696eb643..74a7f43d6e 100644
--- a/services/git-bridge/.gitignore
+++ b/services/git-bridge/.gitignore
@@ -48,3 +48,6 @@ com_crashlytics_export_strings.xml
 crashlytics.properties
 crashlytics-build.properties
 fabric.properties
+
+# Local configuration files
+conf/runtime.json
diff --git a/services/git-bridge/Dockerfile b/services/git-bridge/Dockerfile
index 341535c451..e68f48d942 100644
--- a/services/git-bridge/Dockerfile
+++ b/services/git-bridge/Dockerfile
@@ -2,16 +2,20 @@
 
 FROM maven:3-jdk-8 as base
 
-RUN apt-get update && apt-get install -y make \
+RUN apt-get update && apt-get install -y make git \
  && rm -rf /var/lib/apt/lists
 
+COPY vendor/envsubst /opt/envsubst
+RUN chmod +x /opt/envsubst
+
 RUN useradd --create-home node
 
 FROM base as builder
 
+COPY . /app
+
 WORKDIR /app
 
-COPY . /app
 RUN make package \
 # The name of the created jar contains the current version tag.
 # Rename it to a static path that can be used for copying.
@@ -26,9 +30,17 @@ RUN apt-get update && apt-get install -y git \
 
 RUN useradd --create-home node
 
-ENTRYPOINT ["java", "-jar", "/git-bridge.jar"]
-CMD ["/conf/runtime.json"]
-
 COPY --from=builder /git-bridge.jar /
 
+COPY vendor/envsubst /opt/envsubst
+RUN chmod +x /opt/envsubst
+
+COPY conf/envsubst_template.json envsubst_template.json
+COPY start.sh start.sh
+
+RUN mkdir conf
+RUN chown node:node conf
+
 USER node
+
+CMD ["/start.sh"]
diff --git a/services/git-bridge/Makefile b/services/git-bridge/Makefile
index 9c3cf6ebfc..bea353f6cd 100644
--- a/services/git-bridge/Makefile
+++ b/services/git-bridge/Makefile
@@ -2,8 +2,14 @@
 
 MVN_OPTS := "--no-transfer-progress"
 
-run: package
-	java -jar target/writelatex-git-bridge-1.0-SNAPSHOT-jar-with-dependencies.jar conf/local.json
+runtime-conf:
+	/opt/envsubst < conf/envsubst_template.json > conf/runtime.json
+
+
+run: package runtime-conf
+	java -jar \
+	target/writelatex-git-bridge-1.0-SNAPSHOT-jar-with-dependencies.jar \
+	conf/runtime.json
 
 
 build:
@@ -22,4 +28,4 @@ package: clean
 	mvn $(MVN_OPTS) package -DskipTests
 
 
-.PHONY: run package build clean test
+.PHONY: run package build clean test runtime-conf
diff --git a/services/git-bridge/conf/envsubst_template.json b/services/git-bridge/conf/envsubst_template.json
new file mode 100644
index 0000000000..5f28049481
--- /dev/null
+++ b/services/git-bridge/conf/envsubst_template.json
@@ -0,0 +1,32 @@
+{
+  "port": ${GIT_BRIDGE_PORT:-8000},
+    "rootGitDirectory": "${GIT_BRIDGE_ROOT_DIR:-/tmp/wlgb}",
+    "apiBaseUrl": "${GIT_BRIDGE_API_BASE_URL:-https://localhost/api/v0}",
+    "username": "${GIT_BRIDGE_USERNAME}",
+    "password": "${GIT_BRIDGE_PASSWORD}",
+    "postbackBaseUrl": "${GIT_BRIDGE_POSTBACK_BASE_URL:-https://localhost}",
+    "serviceName": "${GIT_BRIDGE_SERVICE_NAME:-Overleaf}",
+    "oauth2": {
+      "oauth2ClientID": "${GIT_BRIDGE_OAUTH2_CLIENT_ID}",
+      "oauth2ClientSecret": "${GIT_BRIDGE_OAUTH2_CLIENT_SECRET}",
+      "oauth2Server": "${GIT_BRIDGE_OAUTH2_SERVER:-https://localhost}"
+    },
+    "repoStore": {
+      "maxFileNum": ${GIT_BRIDGE_REPOSTORE_MAX_FILE_NUM:-2000},
+      "maxFileSize": ${GIT_BRIDGE_REPOSTORE_MAX_FILE_SIZE:-52428800}
+    },
+    "swapStore": {
+      "type": "${GIT_BRIDGE_SWAPSTORE_TYPE:-noop}",
+      "awsAccessKey": "${GIT_BRIDGE_SWAPSTORE_AWS_ACCESS_KEY}",
+      "awsSecret": "${GIT_BRIDGE_SWAPSTORE_AWS_ACCESS_KEY}",
+      "s3BucketName": "${GIT_BRIDGE_SWAPSTORE_S3_BUCKET_NAME}",
+      "awsRegion": "${GIT_BRIDGE_SWAPSTORE_AWS_REGION:-us-east-1}"
+    },
+    "swapJob": {
+      "minProjects": ${GIT_BRIDGE_SWAPJOB_MIN_PROJECTS:-50},
+      "lowGiB": ${GIT_BRIDGE_SWAPJOB_LOW_GIB:-128},
+      "highGiB": ${GIT_BRIDGE_SWAPJOB_HIGH_GIB:-256},
+      "intervalMillis": ${GIT_BRIDGE_SWAPJOB_INTERVAL_MILLIS:-3600000},
+      "compressionMethod": "${GIT_BRIDGE_SWAPJOB_COMPRESSION_METHOD:-gzip}"
+    }
+}
diff --git a/services/git-bridge/start.sh b/services/git-bridge/start.sh
new file mode 100755
index 0000000000..5547d83a18
--- /dev/null
+++ b/services/git-bridge/start.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+/opt/envsubst < /envsubst_template.json > /conf/runtime.json
+exec java -jar /git-bridge.jar /conf/runtime.json
diff --git a/services/git-bridge/vendor/envsubst b/services/git-bridge/vendor/envsubst
new file mode 100755
index 0000000000..f7ad8081d0
Binary files /dev/null and b/services/git-bridge/vendor/envsubst differ