Docker and CI/CD · Junior · Question 34 of 75

Why shouldn't you copy a `.env` file with secrets into an image?

1Environment files make the image fail to start
2Docker deletes .env files when the build finishes
✓Correct answer: Anyone who can pull the image can read the secrets

Explanation

Image layers are just tar archives; deleting a file in a later layer doesn't remove it from history. Pass secrets at runtime or with build secrets.

Further reading

Test yourself

Take the Docker and CI/CD · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.