Agent Wranglers

Containers Required

Pass build secrets as mounts instead of layers

Give the build a token or key only through a secret mount. Never through ARG, ENV, or a copied file.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Build arguments and environment variables stay readable in the image and its history. With BuildKit, write RUN --mount=type=secret,id=npm_token,env=NPM_TOKEN npm ci and build with --secret id=npm_token. The secret exists only while that step runs. Runtime secrets come from the secrets store.

Example

# Bad: the token stays in the image history
ARG NPM_TOKEN
RUN NPM_TOKEN=$NPM_TOKEN npm ci

# Good: mounted for one step only
RUN --mount=type=secret,id=npm_token,env=NPM_TOKEN npm ci
docker build --secret id=npm_token,env=NPM_TOKEN -t shop .

How to check

docker history --no-trunc shop and a secret scanner run over the saved image find no token.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/containers/build-secrets.