The Best Way to Manage .env Variables in Docker (Compose, Secrets & More)

Baking secrets into Docker images is one of the most common security mistakes in containerized apps. A .env file swept in by COPY, an ENV line in the Dockerfile, or a build argument is all it takes, and anyone who can pull your image can read your database URL and API keys right back out of it. In this video, I'll show you how easy it is to extract secrets from a Docker image, then rebuild the same container the right way: secrets injected at runtime by Infisical, an open source secrets manager, so the image ships your code and nothing else. We'll cover: - How secrets end up baked into Docker image layers - Reading secrets back out of a shipped image - Why deleting a secret in a later Dockerfile step doesn't remove it - Machine identities and Universal Auth - Injecting secrets at runtime with infisical run - Rotating secrets without rebuilding or redeploying images - Scaling the pattern to Docker Compose, the Infisical Agent, and Kubernetes If you ship containers anywhere, a registry, CI, or production, keeping secrets out of your images is one of those foundational habits that will save you from a very bad day later. Docs from the video: Infisical CLI: https://infisical.com/docs/cli/overview Docker Run (inject env vars at runtime): https://infisical.com/docs/integrations/platforms/docker-pass-envs Docker Entrypoint (infisical run in your image): https://infisical.com/docs/integrations/platforms/docker Kubernetes Operator: https://infisical.com/docs/integrations/platforms/kubernetes Infisical Agent: https://infisical.com/docs/integrations/platforms/infisical-agent Follow Infisical: Website: https://infisical.com LinkedIn: / infisical GitHub: https://github.com/Infisical Twitter / X: https://x.com/infisical Slack: https://infisical.com/slack