“secrets”

Build Secrets with BuildKit: Keeping Credentials Out of Layers

Why ARG and ENV secrets stay permanently in image history, and how RUN --mount=type=secret plus the --secret flag keep credentials out of layers.