Docker: Environment variables are no place for secrets

test-env-leak.sh

#!/bin/sh

envfile=$(mktemp)

# Hard set one variable
echo FOO=bar	>> ${envfile}
# and one pass through
echo BAZ	>> ${envfile}
export BAZ="bif"

# run the container
container=$(docker run -d --env-file ${envfile} busybox true)
docker wait ${container}

echo "NOTICE: both FOO and BAZ are recorded"
docker inspect -f '{{.Config.Env}}' ${container}

rm ${envfile}
docker rm ${container}
## Output:
# 0
# NOTICE: both FOO and BAZ are recorded
# [FOO=bar BAZ=bif HOME=/ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin]
# f7f38ba54e48fbda5e446e06d46fa3a62ae0f87f1cc0923bf4c2c3d251f5658f
 

Isn't this WAD? I'm focused.