Set environment variables
Set an environment variable in a container with docker run -e NAME=value. Pass -e NAME with no value to copy the value from the calling shell.
A container needs configuration through environment variables, and you do not want to bake them into the image.
export TOKEN=from-host
docker run --rm -e MODE=debug alpine:3.20 sh -c 'echo "MODE=$MODE TOKEN=${TOKEN-unset}"'
docker run --rm -e MODE=debug -e TOKEN alpine:3.20 sh -c 'echo "MODE=$MODE TOKEN=${TOKEN-unset}"'MODE=debug TOKEN=unset
MODE=debug TOKEN=from-host-e NAME=value sets the variable, and -e NAME copies the variable from the environment of the docker client, which is why the second run sees from-host. The first run shows the default, because nothing is inherited from the host. See the docker run reference. The copying form keeps a secret out of the command line, and so out of ps and the shell history.
Environment variables are visible to docker inspect and to anyone who can read /proc/1/environ in the container, so they are a poor place for long lived secrets. A name that is not set in the client is not passed at all, instead of arriving empty.