advancedScenario-Based & System Design Questions
A container build using `--mount=type=secret` for a private package registry token still seems to leak the token into the final image when inspected with `docker history`.
If the secret was instead passed as a regular `ARG`/`ENV` (not actually via the BuildKit secret mount syntax) or if a RUN step explicitly echoed/logged it, it would persist in image layer history/metadata; verify the Dockerfile genuinely uses `RUN --mount=type=secret,id=token cat /run/secrets/token` syntax correctly scoped to a single RUN instruction, since a secret mount only protects the build if it's used as intended and the secret is never separately captured by another instruction.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response