Which method is a safe way to provide a username/password combination to an application running as a service in a Docker container?

Encoding values in DNS CTEXT entries is not a standard, secure, or scalable method for storing application credentials.

Storing environment variables directly in a Dockerfile makes them visible in the image history and can expose them during image inspection, making this an insecure practice.

Docker environment variables, even passed via 'docker run -e', are less secure than Docker Secrets because they can be easily inspected using 'docker inspect' and may be stored in shell history or logs.

Docker Secrets is the recommended and safest way to manage sensitive data like passwords, API keys, or certificates for Docker Swarm services or standalone containers. Secrets are stored securely, encrypted in transit and at rest, and only mounted into the container's filesystem as an in-memory file at runtime, avoiding exposure in environment variables or image layers.