Start here. This is the direct spoken answer to practice first.
Why this question matters
I would build one environment-neutral image and inject configuration when the container starts. Secrets are runtime inputs from a secret manager or mounted secret, never Dockerfile values or committed environment files.
I would promote the same image to every environment and inject its configuration at runtime. ASP.NET Core can read environment variables and mounted configuration using its normal provider model. I define a clear precedence, use strongly typed options, and validate required settings during startup so a bad deployment fails before serving traffic. Non-secret defaults can live with the application, while connection strings, signing keys, and provider credentials come from the platform's identity and secret facilities.