It allows the container to be less dependent on the host, where you wouldn't necessarily want/have access to the host file system. While one solution would be to make a custom image with the overridden configs, this brings in a security issue where the ssh key and the account hashes got baked in the image. Example in swarm mode: service: satis: ... secrets: - id_rsa - config.php environment: SATIS_ID_RSA: /var/run/secrets/id_rsa SATIS_CONFIG: : /var/run/secrets/config.php