Keep them away from the container and use one or more of the following:

- A vault (Conjur, HCV, something else)

- A built-in credential service that comes with your cloud

- A sidecar that injects credentials or authenticates connections to the backend directly (Secretless Broker, service meshes, etc)

If you are doing a poor man's solution, mounted tmpfs volumes that contain secrets are not terrible (but they're not really that much safer than env vars).