Never bake in secrets

~/shop $ cat DockerfileFROM nginx:1.30-alpineENV DB_PASSWORD=kancil123COPY site/ /usr/share/nginx/html/~/shop $ docker build -t shop:1.0 .[+] Building 0.1s (7/7) FINISHED                                  docker:default => [internal] load build definition from Dockerfile                        0.0s => => transferring dockerfile: 120B                                        0.0s => WARN: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "DB_PASSWORD") (line 2) => [internal] load metadata for docker.io/library/nginx:1.30-alpine        0.0s => [internal] load .dockerignore                                           0.0s => => transferring context: 2B                                             0.0s => [1/2] FROM docker.io/library/nginx:1.30-alpine@sha256:0e52bd054126cdc0  0.0s => => resolve docker.io/library/nginx:1.30-alpine@sha256:0e52bd054126cdc0  0.0s => [internal] load build context                                           0.0s => => transferring context: 135B                                           0.0s => [2/2] COPY site/ /usr/share/nginx/html/                                 0.0s => exporting to image                                                      0.1s => => exporting layers                                                     0.0s => => exporting manifest sha256:77265d7416b79e6aa8d371cacd3f3215a929664ee  0.0s => => exporting config sha256:5a6636cf193c938e2901b31bb63b3efe1d79c93b0ad  0.0s => => exporting attestation manifest sha256:fc83d324dd5546609c3b107e62115  0.0s => => exporting manifest list sha256:8469b3576d7a624bdb8db40a60109fe99154  0.0s => => naming to docker.io/library/shop:1.0                                 0.0s => => unpacking to docker.io/library/shop:1.0                              0.0s 1 warning found (use docker --debug to expand): - SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "DB_PASSWORD") (line 2)~/shop $ docker run --rm shop:1.0 printenv DB_PASSWORDkancil123