title: Docker env vars + Heroku; Heroku requires ENV while local build requires ARG
body: <p>My understanding of Heroku's Docker container-registry CLI was that it was a wrapper around the Docker cli.  </p>
  
  <p>When I build locally I'll use, for example: <code>docker build -f Dockerfile.example --build-arg SECRET_KEY=abc</code>.  And I'll have set <code>ARG SECRET_KEY</code> in my Dockerfile.example.  </p>
  
  <p>However if I want to push up to heroku's docker container-registry, I found out that I need to declare <code>ENV SECRET_KEY=abc</code> in my Dockerfile.example, and then run the command <code>heroku container:push example --recursive</code>.    </p>
  
  <p>Why is the case? What sets them apart? Isn't hardcoding the ENV bad security practice? Does Heroku offer a way around this?  </p>