How to set environment variables in Dockerfile via Azure DevOps

Question

My  environment variables look like this:

ENV ACCEPT_EULA=Y
ENV SA_PASSWORD=Password
ENV MSSQL_PID=Developer
ENV MSSQL_TCP_PORT=1433 

I have 2 pipelines in  Azure DevOps.

There are options to set variables in both these pipelines: 

 I have set the password in both the  pipelines and edited my password in the Dockerfile to look like this:
ENV SA_PASSWORD=$(SA_PASSWORD)

Is this a safe way of passing secrets? Is there any way someone could read secrets from a Docker image?