According to the Twelve-Factor App, where should a service keep configuration such as the database URL and API keys that differ between staging and production?

The Twelve-Factor App stores config in environment variables. This keeps config out of the code. So the same build runs in any environment, and secrets stay out of the repository.

The tempting wrong answer is "Baked into the Docker image at build time". Then you need a separate build for each environment. That breaks the rule "build once, promote the same artifact".