How should environment variables and secrets be managed in Docker?

Explanation & Concept

Secrets (passwords, private keys) should never be baked into Docker image layers using `ENV` or `ARG`, as they persist in the image history.

Use `.env` files with Docker Compose, inject environment variables at runtime via `-e` or `--env-file`, or use Docker Secrets / Kubernetes Secrets.

Code Example

bash

# Run with external secret environment file
docker run --env-file .env.production -d my_service

How It Works & Key Takeaways

Keeping secrets outside the image ensures the same container image can be promoted through staging and production safely.

Mock Test · 1 Questions · Optional

Take a quick test to evaluate yourself, or move straight to the next module.

Intermediate1 questions

Environment Variables & SecretsIntermediate

1Question 1 of 1

bash

Explanation & Concept

Secrets (passwords, private keys) should never be baked into Docker image layers using `ENV` or `ARG`, as they persist in the image history.

Use `.env` files with Docker Compose, inject environment variables at runtime via `-e` or `--env-file`, or use Docker Secrets / Kubernetes Secrets.

Code Example

bash

# Run with external secret environment file
docker run --env-file .env.production -d my_service

How It Works & Key Takeaways

Keeping secrets outside the image ensures the same container image can be promoted through staging and production safely.

Mock Test · 1 Questions · Optional

Take a quick test to evaluate yourself, or move straight to the next module.

Intermediate1 questions