Which practice can help protect secrets in a cloud environment?

Terraform variables are a recommended practice for parameterization and can even reference environment variables or secret managers, so avoiding them does not protect secrets.

Running a privileged Docker runtime expands the attack surface and grants the container elevated host permissions, which is a security risk rather than a protection.

The tfstate file persists all infrastructure state including sensitive data such as database passwords, private keys, and connection strings in plaintext JSON. Committing this file to a code repository exposes these secrets to anyone with repository access. Excluding it via .gitignore and using remote state backends with encryption is the correct mitigation.

The --net=host flag shares the host network namespace with the container for networking purposes and has no relationship to secret management or protection.