Docker Environment Variable Checker
Review Docker Compose environment map/list syntax or .env text, distinguish empty from unresolved values, surface interpolation and env_file precedence clues, and keep secret-like values masked by default.
Parsed environment variables, unresolved/empty states, env_file references, interpolation and secret-handling findings will appear here.
“What Is in My .env File?” and “What Reaches the Container?” Are Different Questions
Docker Compose can receive values from command-line overrides, service environment, service env_file, shell variables, interpolation .env files and image-level ENV. Those sources participate in different precedence rules.
A pasted source can show where values are declared, but not every value that reaches a running container. When resolution depends on shell state, external env files, CLI overrides, or image metadata, the final value is left open instead of being guessed.
Empty and Unresolved Are Not the Same State
environment: EMPTY_VALUE: "" FROM_SHELL: # list syntax environment: - EMPTY_VALUE= - FROM_SHELL
The explicit empty forms create an empty-string value. A key with no value asks Compose to resolve it; if Compose cannot resolve it, the variable is unset and removed from the container environment.
That distinction matters when application code treats “missing” as use-a-default but treats an empty string as a deliberate override.
environment Overrides env_file for the Same Service Variable
Compose service-level env_file loads variables into the container environment, but explicit entries in the service environment attribute take precedence—even when the environment value is empty or undefined.
When multiple env_file entries are listed, Docker Compose processes them in order and a later file can override a variable from an earlier file. The pasted Compose text can show those references and their order, but not the contents of files that remain on your filesystem.
Interpolation Happens Before You See the Final Compose Model
Compose supports forms such as $${VAR}, $${VAR:-default}, $${VAR-default}, $${VAR:?error} and alternative-value operators. Shell and .env/--env-file inputs determine what those expressions become.
Use docker compose config --environment to inspect the variables Compose used for interpolation, and docker compose config to inspect the resolved application model.
Environment Variables Are Convenient, but They Are Not a Secret Store
Passwords, API tokens and database URLs often arrive through environment variables because libraries support them. They can also leak through process inspection, debugging output, crash reports, deployment dashboards and accidental config dumps.
Docker's own Compose guidance recommends secrets instead of environment variables for sensitive information where practical. Secret-like values are masked by default in the review output, but the detection is based on names and patterns. A harmless value can look sensitive, and a real secret can have an ordinary name.
Quote Boolean-Looking Compose Values When You Mean Text
The Compose documentation specifically warns about YAML boolean conversion. An environment variable ultimately reaches the process as text, but the YAML parser can first interpret an unquoted value as a boolean. Quoting "true" or "false" makes the intended string explicit.
docker compose config --environment.