The concept of NOT baking environment variables into a Docker image during build time.

I knew about using ARG for build-time variables and relying on a secret manager for runtime envs. But later I realized that even if we use a multi-stage Dockerfile and copy the entire build stage where ARG is used, the image can still end up with baked-in credentials.

This is harmful from a security perspective and started worrying me.

Then I learned about using --mount in the Dockerfile, which temporarily creates a secret file inside the container and allows passing secrets as an env file during build time, using the same id defined in the Dockerfile.

It works.

This feature is available with Docker BuildKit. Try it if you were unaware, like me.

0 comments