Q: You want to pass a highly sensitive API key to a running container. You know not to bake it into the image, so you pass it as an environment variable (`docker run -e SECRET=apikey`). Why is this still arguably a security vulnerability, and what is the better approach?

Passing secrets via Environment Variables (-e) is insecure because:

• Anyone with access to run docker inspect on the host will see the secret in plaintext in the JSON output.
• If the application crashes, the environment variables are often heavily dumped into the error trace logs.
• The variables are exposed physically in the kernel via /proc//environ, accessible by any other running process grouped with the same owner.

*Better Approach:* Use Docker Secrets (if in Swarm) or K8s Secrets, which act as a temporary RAM-disk tmpfs layer. The secret is securely mounted as a file (e.g., /run/secrets/apikey). The application securely reads the file string into memory once, preventing it from appearing in standard diagnostic dumps.