An ENV baked into a Dockerfile is still build-time injection.
Recoverable from image layers forever — even if the container never prints it.
Build-time (avoid)
Cloud Build fetches the secret → bakes it into an image layer → recoverable via docker history, forever.
Runtime (the safer default)
Pod fetches at startup via Workload Identity → value never touches the image → rotation needs only a re-read.
Warning: a Docker
--build-arg or ENV is build-time injection regardless of whether the running container ever visibly uses the value — it's still recorded in stored layer metadata.