For strictly sensitive information I would recommend not to set it from the CI in plaintext. In this case you can either add an entry script to your container that will get the secret, then pass the name of the secret as an env variable