The production password in the image
The build bakes the production database password into the image so the container starts without extra configuration. It works, and one image is easy to reason about.
It also means the password exists in a registry, in every layer cache, in every developer's pull, and in every backup of all of those. Rotating it requires a rebuild and a redeploy.
Move the secret to something the image never contains.
Components — tap one, then tap a slot on the diagram
!The production password is in the image, so it's in the registry, every layer cache and every pull.
Boundaries, outermost first: Runtime: Running container Outside every boundary: Registry (widely readable; FAILED: holds the secret), Build (produces the image), an empty slot for the supplied at start Connections: Build calls Registry — image only (step 1) Registry calls Running container (step 2) supplied at start controls Running container — never in the image (step 3)
Registrywidely readableholds the secret
Running container
Buildproduces the image