I use docker secrets[0] and a script like this[1] to inject them in the ENV hashmap in my app.

[0]: https://www.docker.com/blog/docker-secrets-management/

[1]: https://gitlab.com/-/snippets/2029832