[jposluns]

TODO 1.296: docker.md's secrets rule had no source for its runtime secret-delivery methods or for keeping .env out of Git.

Change

• Body, secrets bullet: adds what Docker's Compose documentation says about environment variables for sensitive values (it advises secrets instead, and notes they are often available to all processes, hard to track and can be printed in logs) and the same page's env_file section; describes Compose secrets (a file under /run/secrets/, Linux containers only, granted per service) and Swarm secrets (swarm services only, encrypted in transit and at rest, with an in-memory mount in Linux containers). As this guide's reasoning, defining a value in .env does not by itself set the container's environment: the cited examples pass values through an environment entry or load an environment file through an env_file entry, while interpolation can also place values elsewhere in the Compose file. Offering environment files, and their weaker standing, are labelled as this guide's advice and assessment.
• Body, .env bullet: keeping .env in .gitignore, and untracking it if already tracked, is labelled as this guide's advice, citing the Git v2.49.0 gitignore lines already in the guide (matching untracked files are ignored; tracked files are not affected).
• Sources: a new docker-secrets component with eight ranges in the pinned Docker docs commit 4e9a5751 (Compose secrets, container environment, env_file, interpolation into the Compose file, .env interpolation, Swarm secrets).
• The secrets claim now names these sources and drops its "no direct source" sentence; the history caveat stays. The claim is 411 characters, keeping the body's qualifiers and labels.
• TODO 1.296 moves to DONE. New TODO row 1.314 (the next-ID pointer advances to 1.315) carries the out-of-scope workload follow-up (label keeping .env in .gitignore as advice, add untracking, consider advising rotation of any secret ever committed). The header and summary are regenerated; CHANGELOG, VERSION 1.0.703, plugin.json and both bundles are updated.

Not changed: the workload claim (now TODO 1.314); any Verify step or command.

Checks

tools/run_all_checks.sh with the pinned parser first on PATH: all gates passed.

[cloudflare-workers-and-pages]

Deploying secureconfig with    Cloudflare Pages

Latest commit:	7024222
Status:	✅  Deploy successful!
Preview URL:	https://dc540b93.secureconfig.pages.dev
Branch Preview URL:	https://content-docker-secrets-296.secureconfig.pages.dev

View logs