It’s passed correctly to Docker if you use the quotes. The problem is that once it ends up inside discourse.conf, it’s not quoted there - and then # is interpreted as beginning of the comment for that line.
Note that this is very to trip up if you 1) use a mail service that lets you provide your own password, and 2) use a strong password generator. Just spent several days trying to figure out why mail wasn’t working on a fresh Discourse docker install, and this was the culprit.