Builders pass a version string with --build-arg while assembling a court-calendar image. How do ARG and ENV differ for configuration?
Select an answer to reveal the explanation.
Short Explanation
ARG is chalk on the workshop blackboard—gone when the build ends. ENV is a label that stays on the finished machine. Neither place is a safe vault for production secrets.
Full Explanation
ARG supplies build-time values, including those passed with --build-arg while assembling the court-calendar image, and does not automatically become the running process environment. ENV persists into the container environment so the process can read defaults at start. Use ARG for build metadata such as a version string consumed while assembling layers; promote a value to ENV only when the running process must see it. Neither ARG nor ENV is an acceptable vault for production secrets, because both can leave sensitive material in image layers, cache, and history.
ARG values do not automatically become the running container’s environment with no ENV needed. ENV is not stripped before the image is saved—that would defeat its purpose as runtime-visible configuration. ARG and ENV are not identical synonyms; Docker assigns them different lifetimes and scopes on purpose.
Exam caveat: even build-only ARG can appear in image history—treat secrets and credentials as toxic to Dockerfiles and build arguments, and retrieve production secrets at runtime from a proper secret store. Operational check: build with a distinctive --build-arg, run the container, and confirm the value is absent from the process environment unless you also set ENV; keep production secrets out of both instructions.