Hacker News Reader

What they're referring to is more specific than environment variables in general: you can use the ENV command in a Dockerfile to bake in a secret at build time, and that's what you generally shouldn't do.

Injecting environment variables at runtime, however (through docker run -e or whatever orchestration system you're using), is good.

View on HN

Ah yes, that makes sense. I didn't understand they were talking about the ENV command at build time.

It was the heading that got me on the wrong path, I think that should be clarified further:

> Do not store secrets in environment variables

I'm bit aganist having env-secrets inside container.

Because PID 1 has that env, all processes spawned from that can read all of those.

I prefer mounting them to /run/secrets via tmpfs. Which can also have selinux policy attached.

This way, someone else cannot read them by spawning shell inside container

Reply on news.ycombinator.com