Docker’s Secrets Engine lets Compose and docker run use se references instead of putting secret values directly in CLI flags, env files, or compose.yaml. The repo material is mostly README evidence, but it gives useful review points around runtime injection, local keychain-backed providers, plugin boundaries, realms, and the Unix socket API.