How should I handle configuration and secrets in Docker?

Inject runtime configuration separately from the image. Use build secrets for private dependency access instead of ARG or COPY instructions that can persist credentials in layers. Run as a non-root user where possible and grant only the mounts, capabilities and network access the process needs.