A blood-bank courier Container App still embeds the storage account key in a Dockerfile ENV instruction. The team needs to rotate the key without rebuilding image layers. What should the developer do?
Select an answer to reveal the explanation.
Short Explanation
Secrets in a Dockerfile are like writing the vault code on the delivery truck’s paint job—you have to repaint to change it. Container Apps secrets live outside the image and inject as env vars when the revision starts. Rotate the secret, not the layers.
Full Explanation
Hard-coding credentials in Dockerfile ENV layers couples secret rotation to image rebuilds and exposes values in image history. Azure Container Apps lets you define secrets on the app and map them into environment variables for the running container. Key Vault can back those secrets when needed, but the developer action for this item is moving the value out of the image into a Container Apps secret reference.