How should secrets be passed into a container, and why not just use environment variables?

Secrets should be delivered as runtime-mounted files (Docker secrets, Kubernetes Secrets volumes) or fetched from an external vault at startup, not passed via plain environment variables or baked into the image. Environment variables are visible via docker inspect, are readable from /proc/<pid>/environ by anything with sufficient host access, and frequently leak into logs, crash dumps, and CI output — file-based or vault-based delivery avoids all of these exposure paths.