How to Configure Environment Variables Securely in a Docker Container?

Introduction

Environment variables are commonly used in Docker containers to store configuration values such as database URLs, API keys, and application settings. While they make applications flexible, they can also create security risks if not handled properly.

In simple terms, environment variables should make configuration easier without exposing sensitive data. In this article, you will learn how to configure environment variables securely in a Docker container using easy explanations and real-world examples.

What Are Environment Variables in Docker?

Environment variables are key-value pairs that applications read at runtime. In Docker, you can configure containers without changing application code.

Common uses include:

• Database connection strings

• API keys and tokens

• Application environment settings

Example:

ENV APP_ENV=production

This makes the application aware that it is running in a production environment.

Why Security Matters for Environment Variables

Environment variables often contain sensitive information. If they are exposed, attackers can gain access to databases, APIs, or internal systems.

Common risks include:

• Hardcoding secrets in Dockerfiles

• Committing environment files to source control

• Logging environment variables accidentally

Understanding these risks helps you apply the right security practices.

Avoid Hardcoding Secrets in Dockerfiles

Hardcoding secrets directly in a Dockerfile is a major security risk.

Bad example:

ENV DB_PASSWORD=MySecretPassword

Why this is risky:

• Secrets become part of the image

• Anyone with image access can view them

Instead, secrets should be injected at runtime.

Use Environment Variables at Runtime

The safest basic approach is passing environment variables when running the container.

Example:

docker run -e DB_USER=admin -e DB_PASSWORD=secret myapp

Benefits:

• Secrets are not stored in the image

• Different values can be used per environment

This method is simple and suitable for development or small deployments.

Use .env Files Carefully

Docker supports loading environment variables from a file.

Example:

docker run --env-file .env myapp

Example .env file:

DB_USER=admin
DB_PASSWORD=secret

Security tips:

• Never commit .env files to Git

• Add .env to .gitignore

• Restrict file permissions

This approach improves organization but still requires caution.

Secure Environment Variables with Docker Compose

Docker Compose makes managing environment variables easier and cleaner.

Example:

services:
  app:
    image: myapp
    env_file:
      - .env

You can also define variables directly:

environment:
  APP_ENV: production

Docker Compose helps separate configuration from application logic.

Use Docker Secrets for Sensitive Data

For production systems, Docker Secrets provide a more secure way to handle sensitive data.

Key benefits:

• Secrets are stored securely

• Accessible only by authorized containers

• Not exposed in environment variables by default

Example concept:

• Store secret securely

• Mount it inside the container at runtime

This is the recommended approach for passwords, tokens, and keys in production.

Avoid Logging Environment Variables

Be careful not to log environment variables in application logs.

Bad example:

console.log(process.env);

This can accidentally expose secrets in logs.

Instead:

• Log only required non-sensitive values

• Mask sensitive fields

Use Different Variables for Different Environments

Never reuse the same environment variables across all environments.

Best practice: