Docker Secrets Engine resolves secret references like se://foo in docker run and Docker Compose at container startup, then injects the actual values into the container. It uses a secure provider such as docker pass or a custom plugin, so secrets do not need to be stored in environment variables, plaintext files, or directly in compose.yaml.