Cloud and Container Basics
$ docker run -d -e DB_HOST=db.staging.example.com web:1.4.2
$ docker run -d -e DB_HOST=db.prod.example.com web:1.4.2As shown above, the database connection target is not written into the image but passed as an environment variable when the container starts. Which of the following is the most appropriate main advantage of this design?
- AValues put in environment variables are encrypted automatically, so even a password cannot be read by others
- BThe same image can be used in staging and production, with only the settings changed and no rebuild, so what was tested can be released to production as is
- CThe connection information does not go into the image's layers, so the image has fewer layers and containers start much faster
Show answer and explanation
Answer: B. The same image can be used in staging and production, with only the settings changed and no rebuild, so what was tested can be released to production as is
Passing configuration through environment variables is also recommended by the methodology called The Twelve-Factor App, and it separates the code and the image from the environment that runs them. The same image can be used in staging and production, so what reaches production is the same thing that was tested, and there is no need to rebuild the image each time the connection target changes. However, environment variables are not encrypted, so anyone who can see the container configuration or process information can read them. Confidential values such as passwords are passed through mechanisms such as Kubernetes Secrets that restrict who can read them.
- A. Environment variables are not encrypted. Anyone who can inspect the container configuration can read the values.
- B. Correct. Differences between environments are moved into configuration, so the same image can be reused.
- C. A few dozen bytes of settings make almost no difference to the number of layers or the start-up time. The main advantage is separating the image from the environment.