Configuration

Environment variables or Compose secrets?

Separate ordinary configuration from credentials, tokens, and private keys before sharing or committing a Compose project.

Best fit

Environment variables

Non-sensitive, changeable application configuration such as hostnames, ports, feature settings, and deployment mode.

  • • Precedence and interpolation must be understood.
  • • Values can be exposed more broadly to processes.
  • • Do not treat an env file as a universal secret boundary.

Best fit

Compose secrets

Credentials, tokens, certificates, and other sensitive values that should be granted only to the services that need them.

  • • Application images need to support the expected secret-file path.
  • • Secret files still need host access controls.
  • • Upstream app documentation decides the final integration method.

Decision rule

Classify each value by sensitivity first. Use ordinary configuration for non-sensitive settings and the least-broad supported secret mechanism for credentials.

Build the deployment blueprintCheck a Compose file

Editorial record

Maintained by Make Your Own Tools to turn “Validate a deployment” into a defined host, state, exposure, and recovery boundary. The references below provide the technical context for this planning path. Its calculation rules and planning assumptions are documented in the methodology, and affected calculations pass regression checks before the review date advances.

Last reviewed
Evidence set
2 primary references
Read methodology →
Planning scope
Docker Compose configuration and sensitive-value planning.
Next check
A complete host secret-management system or application-specific secret support.
Docker Compose secrets guidanceExplicit secret access and file-backed secret patterns for Compose services.Open source ↗Docker Compose environment-variable guidanceEnvironment configuration and the distinction between variables and sensitive values.Open source ↗