Environment Variable Security — Stop Leaking Secrets

🔧 DevOps Tip — Aug 10, 2026

Environment Variable Security — Stop Leaking Secrets

ENV in a Dockerfile = secret baked into a layer forever. docker history --no-trunc reveals every ENV instruction. Multi-stage builds don't save you.

Where secrets leak:
🚨 ENV in Dockerfiles → permanent image layer leak
🚨 .env committed to git → bots scrape within hours
🚨 ps aux → passwords in command arguments
🚨 CI/CD logs → echo "$SECRET" prints to raw logs
🚨 K8s env: → visible to anyone with get permissions

The fix hierarchy:

# Docker — runtime secrets only
docker run --env-file /run/secrets/app.env myapp
chmod 600 /run/secrets/app.env

# K8s — mount as files, NOT env vars
volumeMounts:

• name: secrets-vol

mountPath: /etc/secrets
readOnly: true

# Systemd — EnvironmentFile=, not Environment=
EnvironmentFile=/etc/myapp/secrets.env
chmod 640 /etc/myapp/secrets.env

Weekly audit one-liner:
docker history --no-trunc myapp:latest | grep -iE "ENV.(PASS|KEY|SECRET)"

💡 Secrets belong in a secrets manager. Start with --env-file and EnvironmentFile=. Graduate to Vault.*