Docker - lesson 6 | HackIndia Skills

Key point

One rule

Do not bake secrets into your image. Pass them at runtime through Compose, and commit only safe example values.

A Dockerfile ENV value stays in the image and can be viewed later. Use it only for harmless defaults, not passwords, API keys, JWT secrets, or database URLs.

Two env files

You usually need two files. One real file for your laptop, and one example file for the repo.

The real file is named .env and should be ignored by Git. The example file can be named .env.example and should be committed.

Example

File setup

Your repo can show reviewers exactly what to create without leaking secrets.

Use values that make sense locally. For a hackathon project, a simple local password is fine in .env.example if it is only for local Docker development.

.gitignore
.env
node_modules

.env.example
APP_PORT=3000
DATABASE_URL=postgres://app_user:app_password@db:5432/app_db
POSTGRES_USER=app_user
POSTGRES_PASSWORD=app_password
POSTGRES_DB=app_db

Example

Compose wiring

Compose can read variables from a .env file in the project directory. It can then pass them into each service container.

Inside the app container, the database host is db because that is the Compose service name.

services:
  app:
    build: .
    ports:
      - "127.0.0.1:${APP_PORT}:3000"
    environment:
      DATABASE_URL: ${DATABASE_URL}
    depends_on:
      - db

  db:
    image: postgres:16
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - db_data:/var/lib/postgresql/data

volumes:
  db_data:

Your to-do

Use it safely

Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.

Create .env by copying .env.example.
Change secrets in .env if the project will be used beyond local testing.
Read env variables in your app code, not from hard-coded strings.
Run the app with the modern docker compose command.
Open the app and test one feature that touches the database.

0 of 5 done

cp .env.example .env
docker compose up --build

Common mistake

Common leak

Beginners put DATABASE_URL or API keys in the Dockerfile with ENV. That makes the value part of the image metadata.

Another common issue is committing .env by mistake. Check git status before pushing your repo.

git status

Tip

Check AI output

If you ask ChatGPT or Gemini to write Compose config, check three things before using it.

It should use docker compose, not old docker-compose. It should start with services:, not a top-level version:. It should not publish database ports unless you really need them from your laptop.