Supplying settings to containers.
WHY CONFIGURATION IS EXTERNAL
The same image should run in every environment.
WHAT THAT PRINCIPLE MEANS
Nothing environment-specific is baked into the image.
WHAT TO SUPPLY AT RUN TIME
Addresses of other services Credentials Feature settings Log level
HOW
Environment variables, or mounted configuration files.
WHAT ENVIRONMENT VARIABLES SUIT
Small values.
WHAT THEY DO NOT SUIT
Large configuration Anything with structure Secrets, arguably
WHY SECRETS ARE QUESTIONABLE THERE
They appear in inspection output, process listings and logs.
WHAT TO USE INSTEAD
A secrets mechanism, mounting them as files.
WHAT TO NEVER DO
Commit an environment file containing real credentials Bake credentials into the image
WHAT TO PROVIDE IN VERSION CONTROL
An example file, with placeholder values.
WHAT TO VALIDATE AT STARTUP
That every required variable is present.
WHY
Failing immediately with a clear message beats failing mysteriously later.
WHAT TO LOG AT STARTUP
Which configuration was loaded, without the secret values.
WHAT TO BE CAREFUL WITH
Defaults that are safe in development and dangerous in production.
WHAT TO PREFER
No default at all for anything security-relevant.
