Probably either via a third party service (such as AWS secrets manager), or mounted as files scoped to the user your process is running as (which is not root, right? :) ).

Typically your host will have a service specifically for secrets. For example: https://docs.github.com/en/free-pro-team@latest/rest/referen...

Two kinds of secrets: build-time (I need an API key to access a download needed to set up the container) and run-time (I need an API key to talk to the database). The post argues against using ENV for build-time secrets, but it's still recommended for run-time secrets. Sibling comments address alternatives for getting build-time secrets in.

using buildkit https://pythonspeed.com/articles/docker-build-secrets/