If using containerise, then use the system env, don't use appsettings json.

As @[email protected] said you can use multiple configuration providers. We usually have local appsettings.json files, even per machine appsettings.<HOSTNAME>.json and then use Environment Variables that are stored in a vault for the production environment. We add the appsettings.<HOSTNAME>.json files to .gitignore so that they don't get checked in.

    var env = Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT");
    configuration.AddJsonFile($"appsettings.{env}.json", optional: true, reloadOnChange: true);
    configuration.AddJsonFile($"appsettings.{Environment.MachineName}.json", optional: true, reloadOnChange: true);
    configuration.AddEnvironmentVariables();

Then you can provide the secrets as environment variables in the form of DATA__ConnectionString

Using DI you can register multiple configuration providers with different priorities. What's common is to have an local.appsetting.json for development and have production setup with environment variables. But you can use any combination of providers.