Ah yes, that makes sense. I didn't understand they were talking about the ENV command at build time.
It was the heading that got me on the wrong path, I think that should be clarified further:
> Do not store secrets in environment variables
It was the heading that got me on the wrong path, I think that should be clarified further:
> Do not store secrets in environment variables
Because PID 1 has that env, all processes spawned from that can read all of those.
I prefer mounting them to /run/secrets via tmpfs. Which can also have selinux policy attached.
This way, someone else cannot read them by spawning shell inside container