You can always add layer with new credentials. E.g. FROM image:staging COPY ./production-credentials/ / When implemented in this way, staging image wo

You can always add layer with new credentials. E.g. FROM image:staging COPY ./production-credentials/ / When implemented in this way, staging image won't be able to run in production code until it will be tested and accepted (sealed) using formal process. If you will use environment variables, you (or your deployment team) will be able to run staging images in production at any moment.