How do you manage configuration and secrets for a containerized FastAPI app?

WHAT THIS TESTS: This question probes two distinct senior-level concerns. First, do you follow 12-factor methodology by strictly separating configuration from code so the same container image can promote from dev to staging to production without rebuilds. Second, do you understand Docker layer immutability and the security implications of build-time versus runtime secret injection.

A GOOD ANSWER COVERS: A strong response walks through four specific practices in order. First, use pydantic-settings to declare a Settings class that reads environment variables with type validation and defaults, which FastAPI recommends for managing config. Second, inject secrets at container runtime using docker run with -e flags, Docker Compose environment sections, or Kubernetes Secrets mounted as environment variables or files under /run/secrets. Third, cache the Settings instance with functools.lru_cache so it is built once at module import rather than on every request, which avoids repeated disk or env lookups and improves latency. Fourth, restrict .env files to local development only and explicitly exclude them from both version control via .gitignore and image builds via .dockerignore.

COMMON WRONG ANSWERS: Red flags that immediately signal junior-level thinking include hardcoding database URLs or API keys directly into Python source files or Dockerfile instructions, which embeds secrets in image layers forever. Another anti-pattern is copying a .env file into the container during the Docker build; even if you delete it in a later layer, it remains accessible in the layer history. Similarly, committing .env files to git exposes secrets in repository history. Some candidates suggest reading secrets from a baked-in JSON or YAML config file inside the image, which violates the 12-factor principle and creates the same layer leakage risk.

LIKELY FOLLOW-UPS: Interviewers often push deeper by asking how you would rotate a database password without rebuilding the image, which should be answered by restarting the container to pick up new environment variables. They may ask how to handle secrets in a multi-environment CI/CD pipeline, where you should mention per-environment secret stores like AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault injected at deploy time. Another follow-up is how you handle local development ergonomics without compromising production security, which is exactly where a gitignored .env file read by pydantic-settings fits in.

ONE CONCRETE EXAMPLE: Imagine a FastAPI app connecting to PostgreSQL. You define a Settings class with pydantic-settings where DATABASE_URL is a PostgresDsn field and SECRET_KEY is a str. In local development, you keep a .env file with dummy credentials and add both .env and .dockerignore to .gitignore. Your Dockerfile copies only requirements and source code, never .env. In production, your Kubernetes deployment references a Secret named api-secrets where DATABASE_URL and SECRET_KEY are defined; the pod spec injects them as environment variables. The FastAPI app calls get_settings cached with lru_cache, reads the variables at startup, and fails fast with a validation error if any required secret is missing.