[ben_straub]

You effectively build your configuration file into the thing that knows how to run your container. If you're running Kubernetes, this is either a secret or the replication controller definition file. For docker-compose, this is the `docker-compose.yml` file. Or it's the script that starts your container.

But it's pretty common to put service credentials into a config file, so it's an anti-pattern to version-control them. It's _way_ safer not to, which means you shouldn't be version-controlling the thing that runs your container? This is sort of tricky. We're doing it by volume-mapping a non-version-controlled file for database credentials, and storing the rest of the configuration in the database.

[jacques_chester]

In CF-land the most common pattern I've seen for important keys is a "secrets" repository which is merged with the base config at push time.

[andybak]

With Ansible you have an encrypted vault file that stores your secrets. Similar principle I guess.