Docker Secrets
https://docs.docker.com/engine/swarm/secrets/
The docker container should be able to utilize docker secrets in accessing sensitive information, such as the bot's password and the API key. This can be done with docker secrets, and reading the value from a file (/run/secrets/<secret_name>). The docker image would need to support reading the current environment variables (or a subset of them) from a file. The standard way of doing this is to append _FILE to the end of the env var name, and reading from that file if the original env var is empty. So then a user could create a docker secret named bot_password and set the environment variable BOT_PASSWORD_FILE to /run/secrets/bot_password.
For a working example, see PostgresSQL
Interesting, I'd have to read more about that. First I want to smash some serious bugs but feel free to open a PR!