Chapter 7: Docker Commands, Networks, Volumes and Compose
7.6 Env files — never commit real secrets
Create a .env next to the Compose file for local labs. Compose loads it for ${POSTGRES_PASSWORD}.
# .env — LOCAL LAB ONLY — add to .gitignore
POSTGRES_PASSWORD=lab-only-change-me
# .gitignore excerpt
.env
.env.*
!.env.example
Ship an .env.example with fake placeholders so a teammate knows the key names, without a real password.
| Do | Do not |
|---|---|
Keep .env gitignored |
Commit a production password |
| Rotate a password that reached a public repo | Reuse one lab password everywhere |
| Use the platform's secret store in CI later | Paste cloud keys into the YAML |
Ravindra Bagale's Tip
Khup students .env git add . ne push kartat. git status pahile — .env untracked rahila pahije. Commit zala tar password rotate kara. Dhyan rakho!
Revision card
Interview card