Introduction

Docker’s --env-file option lets you load environment variables from a simple key-value file. In Kubernetes, the closest equivalent is usually a ConfigMap or Secret combined with envFrom or individual env entries. The important nuance is that Kubernetes splits "non-sensitive config" and "sensitive config" into different resource types instead of treating everything as one plain file.

Use a ConfigMap for Non-Sensitive Variables

If your .env file contains ordinary configuration such as ports, hostnames, or feature flags, create a ConfigMap.

You can do that directly from an env-style file:

kubectl create configmap app-env --from-env-file=.env

If .env contains:

APP_MODE=dev
API_URL=https://api.example.com
TIMEOUT_SECONDS=30

then the ConfigMap stores those keys for later injection into pods.

Inject All Values with envFrom

The closest behavior to Docker --env-file is envFrom, which imports every key from the referenced ConfigMap.

1apiVersion: v1
2kind: Pod
3metadata:
4  name: demo
5spec:
6  containers:
7    - name: app
8      image: nginx:latest
9      envFrom:
10        - configMapRef:
11            name: app-env

That causes each key in app-env to become an environment variable inside the container.

This is the nearest Kubernetes equivalent to "load this env file into the container."

Use a Secret for Sensitive Values

If the file contains passwords, tokens, or API keys, use a Secret instead.

kubectl create secret generic app-secret --from-env-file=.env.secret

Then inject it the same way:

1apiVersion: v1
2kind: Pod
3metadata:
4  name: demo
5spec:
6  containers:
7    - name: app
8      image: nginx:latest
9      envFrom:
10        - secretRef:
11            name: app-secret

This keeps secret material in the resource type meant for sensitive configuration instead of mixing it with ordinary config.

Inject Specific Keys When You Need Control

Sometimes you do not want the whole file imported. In that case, map only the keys you need.

1apiVersion: v1
2kind: Pod
3metadata:
4  name: demo
5spec:
6  containers:
7    - name: app
8      image: nginx:latest
9      env:
10        - name: API_URL
11          valueFrom:
12            configMapKeyRef:
13              name: app-env
14              key: API_URL
15        - name: API_TOKEN
16          valueFrom:
17            secretKeyRef:
18              name: app-secret
19              key: API_TOKEN

This is more verbose than envFrom, but it is better when you want tighter control over naming or exposure.

Do Not Confuse This with Docker Compose .env

There are two similar Docker concepts people often blur together:

• 'docker run --env-file injects environment variables'
• Docker Compose .env also participates in variable substitution inside the YAML file

Kubernetes ConfigMap and Secret resources solve the injection side. Templating or substitution inside manifests is usually handled by tools such as Helm, Kustomize, or CI/CD pipelines rather than by Kubernetes itself.

That distinction matters. Kubernetes does not have one built-in feature that behaves exactly like every Docker .env use case.

Common Pitfalls

The first mistake is putting secrets into a ConfigMap. If the value is sensitive, use a Secret.

Another issue is expecting running pods to automatically refresh their environment variables after a ConfigMap or Secret change. Environment variables are set when the container starts, so pods usually need to be restarted or rolled out again.

Formatting problems also happen. --from-env-file expects simple KEY=VALUE lines. Shell expressions, export prefixes, and complex quoting rules from other tools do not always translate cleanly.

Finally, remember that envFrom imports everything. If the referenced resource contains more keys than the container should receive, use explicit env mappings instead.

Summary

• The Kubernetes equivalent of Docker --env-file is usually a ConfigMap or Secret plus envFrom.
• Create a ConfigMap with kubectl create configmap --from-env-file.
• Create a Secret with kubectl create secret generic --from-env-file for sensitive data.
• Use envFrom to import all keys, or env to map selected keys.
• Kubernetes config injection is not the same thing as Docker Compose .env file substitution.