Environment in containers

What you will be able to do

• Pass a variable into a container with -e and with --env-file
• Print the environment from inside a container
• State the rule for lab passwords versus real secrets

Why this matters for DE and AI

Images are copied. Environment is per run. POSTGRES_PASSWORD, AWS_PROFILE, DATABASE_URL belong in env (or a secret store), not in a RUN echo password= layer and not in a public git repo. You already saw the idea in Linux environment variables. Docker is where those names actually get into the process.

Concepts

docker run --rm -e GREETING=hello alpine:3.20 sh -c 'echo $GREETING'

-e NAME=value sets one variable in the container.

--env-file file reads NAME=value lines. Comments start with #. No export keyword.

Official database images look for specific names (POSTGRES_PASSWORD, POSTGRES_USER, POSTGRES_DB). If they are missing, the container exits. docker logs will say so.

Compose uses environment: and env_file: — same values, YAML instead of flags. Next two lessons.

docker inspect can print env. Anyone with access to the engine can read them. That is acceptable for a local lab; it is not a vault.

Practice on your machine

cd ~/dcubes/docker-lab
docker run --rm -e GREETING=hello alpine:3.20 sh -c 'echo $GREETING'

What you should see: hello

Without -e, the same command prints an empty line (the variable is unset).

Write an env file for the lab (this one is allowed to be boring):

cat > ~/dcubes/docker-lab/lab.env << 'EOF'
GREETING=from-file
LAB_NAME=docker-lab
EOF

docker run --rm --env-file ~/dcubes/docker-lab/lab.env alpine:3.20 sh -c 'echo $GREETING $LAB_NAME'

What you should see: from-file docker-lab

Confirm the process environment (truncated):

docker run --rm -e GREETING=hello alpine:3.20 env | sort

You should see GREETING=hello among other names (PATH, HOME).

Optional: start a named container and inspect env:

docker run -d --name dcubes-env -e GREETING=inspect-me alpine:3.20 sleep 60
docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' dcubes-env
docker rm -f dcubes-env

GREETING=inspect-me should appear. -f on rm is force-remove (stop + rm). Fine for this sleeper.

Common mistakes

• Spaces around = in env files. GREETING = hello is a different, wrong line.
• Baking -e values into a shared screenshot. Treat even lab dumps as if they might leak.
• Expecting --env-file to substitute into a Compose image: line. It sets the container environment, not the YAML parser.

Next

Compose up — a YAML file, docker compose up, and down.