is a secrets-provider-container a good idea? I am looking for a way to provide secrets to a container running on Google Cloud Run responding to the following criteria:

secure
centralized &amp; pulled based
free
simple
working with a team, with various trust scopes
host agnostic: changing 1 config will be the same on aws, gcp, azure

When starting a new project with containers, I always come to the point where I need to manage secrets, and I often find it difficult.  My current solution is to store my secrets encrypted on a public git repository, and decrypt them inside the container, in the entry point script.
But I don't like so much installing gpg along with Django and it's dependencies. I am now thinking of running another container on the same network, which sole responsibility will be serving the config to the first container.
Is it secure ? Is there a better way ?
There is probably a better way if you are working with Google Cloud Run.  I have not tried this but I see that they have &quot;Secret Manager&quot; that you can use.  They also mention a project Berglas that can be used to store secrets in GCS cloud storage.
In my personal experience, it find it best to leverage widely adopted solutions and avoid creating a unique solution for security.  Getting it right is non trivial and it is less code you have to support.
This FAQ has doc links to the solutions I mentioned.  https://github.com/ahmetb/cloud-run-faq#how-to-configure-secrets-for-cloud-run-applications