I am using dockerfile and Azure devops to build and push the image to a registry. I have an appsettings.development and also production files. I need to securely inject them into my image during build.

• My appsettings contains secrets and also non-secrets but I heard pushing these to a repo is bad practice. I am doing this (not the actual secrets, mine are being applied during runtime some of them using env) e.g docker run -e

• I have also seen in other posts using —build-arg is insecure

• So how do I go about the above in terms of best practice? I’d prefer maybe an example without keyvault and one with. As short term possibly will use Azure Devops variables. Or any other recommended approaches.

• I want to do it during build as i have more control in this space

Dockerfile

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build-env
WORKDIR /app
EXPOSE 80
EXPOSE 443

COPY *.csproj ./
RUN dotnet restore

COPY . ./
RUN dotnet publish -c Release -o out

# Build runtime image
FROM mcr.microsoft.com/dotnet/aspnet:8.0
ARG ASPNETCORE_ENVIRONMENT=Production
ENV ASPNETCORE_ENVIRONMENT=${ASPNETCORE_ENVIRONMENT}

WORKDIR /app
COPY --from=build-env /app/out .
ENTRYPOINT ["dotnet", "API.dll"]

Azure Devops Pipeline

trigger: none

pool:
  vmImage: 'ubuntu-latest'

steps:

- task: Docker@2
  displayName: login
  inputs:
    containerRegistry: 'docker_registry'
    command: login

- task: Docker@2
  displayName: build
  inputs:
    containerRegistry: 'docker_registry'
    repository: web/api
    command: build
    tags: |
      latest
    arguments: '--build-arg ASPNETCORE_ENVIRONMENT=Development

- task: Docker@2
  displayName: push
  inputs:
    containerRegistry: 'docker_registry'
    repository: web/api
    command: push
    tags: |
      latest