Externalize Docker Configuration with Environment Variables and Compose Secrets

Configuration is one of the few things that legitimately differs between a developer laptop, a staging cluster, and production. The twelve-factor methodology codifies this with its third factor: store config in the environment, never in the code. Docker takes that doctrine and gives developers a layered toolkit for honoring it — the -e flag for one-off overrides, --env-file for bundling related variables, the Compose environment: and env_file: directives for declarative service definitions, and the Compose secrets: block for credentials that should never appear in a process listing.

These layers exist because not all config is equal. A non-sensitive value like an app name belongs in a checked-in .env.example. A connection string belongs in an environment-specific .env file that stays out of source control. And a database password belongs nowhere near a process environment — it should be mounted as a file at /run/secrets/<name> so it never appears in docker inspect or process listings. In this lab, you will progressively externalize the config of a small Node.js HTTP service, starting from a hardcoded anti-pattern and ending with a 12-factor-clean container whose only inputs are an --env-file and a file-backed Compose secret, with .dockerignore ensuring no secrets ever leak into a built image.

Objectives

Upon completion of this intermediate-level lab, you will be able to:

• Run a containerized app with config injected via -e VAR=value flags
• Bundle related variables into a .env file and load them with --env-file
• Declare configuration in docker-compose.yml using environment: and env_file: directives with variable substitution
• Mount a sensitive credential as a file-backed Compose secret at /run/secrets/<name>
• Prevent secret leakage into images using .dockerignore

Who is this lab for?

This lab is designed for:

• Developers adopting the 12-factor configuration pattern in containerized apps
• Platform engineers separating secrets from non-sensitive config in Compose stacks
• Security-minded practitioners hardening Docker workflows against credential leaks