You effectively build your configuration file into the thing that knows how to run your container. If you&#x27;re running Kubernetes, this is either a secret or the replication controller definition file. For docker-compose, this is the `docker-compose.yml` file. Or it&#x27;s the script that starts your container.<p>But it&#x27;s pretty common to put service credentials into a config file, so it&#x27;s an anti-pattern to version-control them. It&#x27;s _way_ safer not to, which means you shouldn&#x27;t be version-controlling the thing that runs your container? This is sort of tricky. We&#x27;re doing it by volume-mapping a non-version-controlled file for database credentials, and storing the rest of the configuration in the database.