How to Keep Passwords Out of compose.yaml with an .env File
A password typed into compose.yaml ends up in Git, and then in every copy of the repository. Docker Compose can read passwords from a separate .env file instead, and with one small piece of syntax it refuses to start when they're missing. This guide sets that up for a MySQL container, with the real output of every check.
