A regional blood-bank courier app COPY-includes a .env file that holds a storage account key, and that layer is now in every registry replica. What is the correct image-hygiene fix at build time?
Select an answer to reveal the explanation.
Short Explanation
Baking a storage key into an image layer is like laminating your house key into every photocopy of the floor plan. Leave secrets out of COPY, ignore them in .dockerignore, and hand configuration in when the container actually runs.
Full Explanation
Anything COPY adds becomes part of immutable image layers and travels with every push and pull. Secrets belong outside the image—supplied at run time through environment variables, mounts, or later-domain stores such as Key Vault—not embedded in build context. Renaming files, encrypting comments, or changing ACR SKUs does not remove a secret already in a layer.