How do Docker secrets differ from environment variables for sensitive data?

Environment variables are visible via `docker inspect`, process listings, and often end up logged or in crash dumps. Docker secrets (in Swarm) are mounted as in-memory files only accessible to authorized services, not exposed via inspect or typical process introspection, providing meaningfully better protection for credentials.