Guides
How to pass secrets into a Docker build
You need a private registry token or SSH key during the build.
4 min read
You need a private registry token or SSH key during the build.
Why it happens
ARG and ENV values persist in the image history and are trivially recoverable.
How to fix it
- Use BuildKit build secrets with --secret, mounted only for the RUN that needs them
- Use --ssh for SSH agent forwarding to fetch private dependencies
- Never bake a credential into a layer, even a discarded one
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.
Related
How to set up Docker layer cachingDocker builds take ten minutes because every layer rebuilds.How to optimise a Dockerfile for CISmall code changes trigger long rebuilds.How to use multi-stage Docker buildsImages are large and contain build tooling that should not ship.How to run concurrent Docker builds safelyParallel matrix legs contend and builds slow down or fail.