What's the difference between mounting a Secret as a volume versus injecting it as an environment variable, from a security perspective?

Volume mounts are generally considered safer: environment variables are more easily and more commonly leaked — they get dumped in crash reports and error-tracking tools, are visible to any process that can read /proc/<pid>/environ on the host or inside the container, often get logged accidentally by application frameworks, and are inherited by every child process spawned from the container. A mounted file requires deliberately reading a specific path and isn't subject to most of those accidental-exposure paths by default.

Environment variables are inherited by child processes automatically, by design: this is exactly the behavior that makes env vars convenient for configuration, but it also means every subprocess a container spawns — including debugging shells, third-party libraries the app calls out to, or a crash-handling subprocess — gets a copy, widening the exposure surface without any deliberate action by the application.

Environment variables commonly end up in logs and error trackers: many application frameworks and crash-reporting tools automatically dump the process environment when logging an unhandled exception, as a debugging convenience — this means a Secret injected via env var can end up captured in an error-tracking service (Sentry, Rollbar, or similar) or application logs without anyone intending to log it, purely as a side effect of a crash.

/proc/<pid>/environ makes env vars readable by anything with sufficient access to the process: on the host or within a container, any process able to read another process's /proc/<pid>/environ (subject to normal Linux permission boundaries) can see its environment — this is a broader exposure surface than a file that requires knowing and reading a specific path.

A mounted file requires deliberate action to read, and isn't inherited by child processes automatically: a volume-mounted Secret exists as a file at a known path — an application (or an attacker with code execution in the container) still has to read it, but it isn't automatically propagated to every subprocess, and standard file permissions (which can be set more restrictively than a blanket environment inheritance) apply.

Neither approach protects against a fully compromised container: if an attacker has arbitrary code execution inside the container, they can read a mounted Secret file just as easily as an environment variable — the security difference here is specifically about accidental exposure (logs, crash reports, child-process inheritance), not about protecting against a fully compromised workload, which requires other controls entirely (network policy, RBAC limiting blast radius, runtime detection).

Practical guidance: for genuinely sensitive values (database credentials, API keys, signing keys), prefer volume mounts where the application supports reading from a file — many mature applications and frameworks support this exact pattern (reading a credential from a file path specified by a different, non-sensitive environment variable, like DB_PASSWORD_FILE=/etc/secrets/db-password) specifically to get the convenience of configuration-via-env-var for the path while keeping the actual sensitive value off the environment entirely.

• Environment variables are more prone to accidental exposure — automatic inheritance by child processes, common capture in crash reports/logs, and broader host-level readability via /proc.
• A mounted Secret file requires deliberate reading and isn't automatically inherited by subprocesses, narrowing (though not eliminating) accidental-exposure paths.
• Neither approach defends against a fully compromised container with arbitrary code execution — that requires separate controls.
• The _FILE environment variable convention (pointing to a file path, not the secret value itself) combines the convenience of env-var-driven configuration with the safety of file-based secret delivery.

• Kubernetes: Secrets — Risks
• OWASP: Secrets Management Cheat Sheet