How do environment variables and Docker secrets help manage application configuration and sensitive credentials differently across development and production containerized environments?

Environment variables passed into a container let the exact same Docker image behave differently based on its deployment context, such as connecting to a different database host in development versus production, while sensitive values like passwords should ideally be provided using a dedicated secrets management mechanism, such as Docker secrets or an external secrets manager, rather than being baked directly into an image or passed as plain environment variables that might be more easily exposed or logged accidentally.

services:
  app:
    environment:
      DB_HOST: ${DB_HOST}
    secrets:
      - db_password
secrets:
  db_password:
    external: true