I like the simplicity of envars too, but they shouldn't be used for secrets. They are not designed to be secure, and are too easy to leak. Containers often allow placing secrets into files, and specifying the filepath in an envar. Files have access controls that are designed for security, so while it takes some thought, they are easier to secure.