Secrets and Containers

Secrets live in the host's configuration. Never in git, never in an image, never in the frontend bundle. Rotate anything that ever reached a public repository, because deleting the commit does not remove it from the history.

Each environment gets its own, so staging cannot touch production data.

What containers actually solve. Docker packages the application with its dependencies so it runs the same on your machine as on the server, which removes the 'works on mine' class of problem.

What they do not solve: a badly configured application is equally broken in a container. Adopt one when the environment differences are actually costing you, not because it appears on job descriptions. And the practical wins are ordinary — a small base image, a .dockerignore, and not running as root.