Environment Variables and Secrets

Part of the Docker course

Your image works on your laptop. Now it needs to run in staging with a different database, and in production with a different one again, and the production database password must not be readable by anyone who can download the image. Building three images is obviously wrong: they would differ only in a handful of strings, and the whole promise of a container is that the artifact you tested is the artifact you ship.

So configuration has to arrive from outside the image, at the moment the container starts. Docker gives you several ways to do that, and one of them leaks secrets permanently while looking exactly like the others. ...