3 ms·
Ah yes, that makes sense. I didn't understand they were talking about the ENV command at build time. It was the heading that got me on the wrong path, I think
by naranha 6y ago
Ah yes, that makes sense. I didn't understand they were talking about the ENV command at build time.
It was the heading that got me on the wrong path, I think that should be clarified further:
> Do not store secrets in environment variables
- pvtmert 6y agoI'm bit aganist having env-secrets inside container. Because PID 1 has that env, all processes spawned from that can read all of those. I prefer mounting them to /run/secrets via tmpfs. Which can also have selinux policy attached. This way, someone else cannot read them by spawning shell inside container