Hacker News Reader

> Using ENV to store secrets is bad practice because Dockerfiles are usually distributed with the application

Nevermind Dockerfiles, env variables are preserved in stopped containers that are hanging around even when you use docker-machine AFAIK, you can easily `docker inspect` them.

View on HN

Always use `--rm` flag to automatically remove containers when it exits could probably be another best practice.

Is this referring to ENVs inside the Docker image or on the system running it as a whole?

Aren’t they the same thing (sort of)? The ENV in Dockerfile (or .env if you’re doing docker-compose) will be available during the build as well as runtime.

Reply on news.ycombinator.com