Passing secrets through docker cmdline option was a bad idea