{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/pass-docker-build-credentials-through-dedicated-secret-mounts/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/pass-docker-build-credentials-through-dedicated-secret-mounts/",
        "slug": "pass-docker-build-credentials-through-dedicated-secret-mounts",
        "url": "https://update.dsesecurity.com/updates/pass-docker-build-credentials-through-dedicated-secret-mounts/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/pass-docker-build-credentials-through-dedicated-secret-mounts.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/pass-docker-build-credentials-through-dedicated-secret-mounts/"
        },
        "title": "Pass Docker build credentials through dedicated secret mounts",
        "summary": "Build arguments and environment variables can leave credentials in the resulting image.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "physical-security",
            "label": "Physical security",
            "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:15:19+00:00",
        "modified_at": "2026-10-20T18:34:33+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 261,
        "potentially_affected": "Review credentials consumed during image build through Docker's secret or SSH mount workflow.",
        "dse_recommendation": "DSE recommends inventorying private package, repository, and signing access used by the build.",
        "primary_source": {
            "name": "Docker documentation — Build secrets",
            "url": "https://docs.docker.com/build/building/secrets/",
            "published_on": null,
            "authority": "docs.docker.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Build arguments and environment variables can leave credentials in the resulting image.</p>\n<h2>Source facts</h2>\n<p>Docker documents build arguments and environment variables as inappropriate ways to pass build secrets because they persist in the image. Secret mounts or SSH mounts are the supported alternatives. The workflow has two parts: pass the secret to the build command, then consume it in the Dockerfile. A secret mount is temporarily available for the relevant build instruction.</p>\n<p>Source: <a href=\"https://docs.docker.com/build/building/secrets/\">Docker documentation — Build secrets</a>.</p>\n<h2>Applicability</h2>\n<p>Review credentials consumed during image build through Docker&#8217;s secret or SSH mount workflow.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends inventorying private package, repository, and signing access used by the build. Replace embedded credentials with the supported mount mechanism and keep secret values out of Dockerfile arguments, logs, and diagnostic traces. Review the build instruction to ensure it does not write the credential into an artifact that is later copied into the final image. Assign rotation and access ownership to the build identity. Separate the credential’s lifecycle from the generated image’s deployment lifecycle.</p>\n<h2>Verification</h2>\n<p>In an isolated build using a disposable credential, inspect the final image’s intended files and relevant metadata without printing secret values. Confirm the build succeeds only through its approved secret input and that the credential is unavailable to ordinary runtime processes. Revoke the disposable credential after verification. Retain the reviewed instruction and a sanitized inventory of the final artifact. Have the build owner identify any intermediate output that could copy sensitive material, and verify its disposition before accepting the credential-handling change.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.docker.com/build/building/secrets/\">Docker documentation — Build secrets</a>. Reviewed October 20, 2026.</p>",
        "content_text": "Build arguments and environment variables can leave credentials in the resulting image.\nSource facts\nDocker documents build arguments and environment variables as inappropriate ways to pass build secrets because they persist in the image. Secret mounts or SSH mounts are the supported alternatives. The workflow has two parts: pass the secret to the build command, then consume it in the Dockerfile. A secret mount is temporarily available for the relevant build instruction.\nSource: Docker documentation — Build secrets.\nApplicability\nReview credentials consumed during image build through Docker’s secret or SSH mount workflow.\nDSE recommendation\nDSE recommends inventorying private package, repository, and signing access used by the build. Replace embedded credentials with the supported mount mechanism and keep secret values out of Dockerfile arguments, logs, and diagnostic traces. Review the build instruction to ensure it does not write the credential into an artifact that is later copied into the final image. Assign rotation and access ownership to the build identity. Separate the credential’s lifecycle from the generated image’s deployment lifecycle.\nVerification\nIn an isolated build using a disposable credential, inspect the final image’s intended files and relevant metadata without printing secret values. Confirm the build succeeds only through its approved secret input and that the credential is unavailable to ordinary runtime processes. Revoke the disposable credential after verification. Retain the reviewed instruction and a sanitized inventory of the final artifact. Have the build owner identify any intermediate output that could copy sensitive material, and verify its disposition before accepting the credential-handling change.\nOfficial reference\nDocker documentation — Build secrets. Reviewed October 20, 2026.",
        "content_markdown": "Build arguments and environment variables can leave credentials in the resulting image.\n\n## Source facts\n\nDocker documents build arguments and environment variables as inappropriate ways to pass build secrets because they persist in the image. Secret mounts or SSH mounts are the supported alternatives. The workflow has two parts: pass the secret to the build command, then consume it in the Dockerfile. A secret mount is temporarily available for the relevant build instruction.\n\nSource: [Docker documentation — Build secrets](https://docs.docker.com/build/building/secrets/).\n\n## Applicability\n\nReview credentials consumed during image build through Docker’s secret or SSH mount workflow.\n\n## DSE recommendation\n\nDSE recommends inventorying private package, repository, and signing access used by the build. Replace embedded credentials with the supported mount mechanism and keep secret values out of Dockerfile arguments, logs, and diagnostic traces. Review the build instruction to ensure it does not write the credential into an artifact that is later copied into the final image. Assign rotation and access ownership to the build identity. Separate the credential’s lifecycle from the generated image’s deployment lifecycle.\n\n## Verification\n\nIn an isolated build using a disposable credential, inspect the final image’s intended files and relevant metadata without printing secret values. Confirm the build succeeds only through its approved secret input and that the credential is unavailable to ordinary runtime processes. Revoke the disposable credential after verification. Retain the reviewed instruction and a sanitized inventory of the final artifact. Have the build owner identify any intermediate output that could copy sensitive material, and verify its disposition before accepting the credential-handling change.\n\n## Official reference\n\n[Docker documentation — Build secrets](https://docs.docker.com/build/building/secrets/). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/pass-docker-build-credentials-through-dedicated-secret-mounts/",
                "url": "https://update.dsesecurity.com/updates/pass-docker-build-credentials-through-dedicated-secret-mounts/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/pass-docker-build-credentials-through-dedicated-secret-mounts/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "IT",
                        "item": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Pass Docker build credentials through dedicated secret mounts",
                        "item": "https://update.dsesecurity.com/updates/pass-docker-build-credentials-through-dedicated-secret-mounts/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/pass-docker-build-credentials-through-dedicated-secret-mounts/#article",
                "identifier": "https://update.dsesecurity.com/updates/pass-docker-build-credentials-through-dedicated-secret-mounts/",
                "url": "https://update.dsesecurity.com/updates/pass-docker-build-credentials-through-dedicated-secret-mounts/",
                "headline": "Pass Docker build credentials through dedicated secret mounts",
                "description": "Build arguments and environment variables can leave credentials in the resulting image.",
                "abstract": "Build arguments and environment variables can leave credentials in the resulting image.",
                "articleBody": "Build arguments and environment variables can leave credentials in the resulting image.\nSource facts\nDocker documents build arguments and environment variables as inappropriate ways to pass build secrets because they persist in the image. Secret mounts or SSH mounts are the supported alternatives. The workflow has two parts: pass the secret to the build command, then consume it in the Dockerfile. A secret mount is temporarily available for the relevant build instruction.\nSource: Docker documentation — Build secrets.\nApplicability\nReview credentials consumed during image build through Docker’s secret or SSH mount workflow.\nDSE recommendation\nDSE recommends inventorying private package, repository, and signing access used by the build. Replace embedded credentials with the supported mount mechanism and keep secret values out of Dockerfile arguments, logs, and diagnostic traces. Review the build instruction to ensure it does not write the credential into an artifact that is later copied into the final image. Assign rotation and access ownership to the build identity. Separate the credential’s lifecycle from the generated image’s deployment lifecycle.\nVerification\nIn an isolated build using a disposable credential, inspect the final image’s intended files and relevant metadata without printing secret values. Confirm the build succeeds only through its approved secret input and that the credential is unavailable to ordinary runtime processes. Revoke the disposable credential after verification. Retain the reviewed instruction and a sanitized inventory of the final artifact. Have the build owner identify any intermediate output that could copy sensitive material, and verify its disposition before accepting the credential-handling change.\nOfficial reference\nDocker documentation — Build secrets. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:15:19+00:00",
                "dateModified": "2026-10-20T18:34:33+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/pass-docker-build-credentials-through-dedicated-secret-mounts/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/pass-docker-build-credentials-through-dedicated-secret-mounts/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Pass Docker build credentials through dedicated secret mounts"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 261,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Docker documentation — Build secrets",
                    "url": "https://docs.docker.com/build/building/secrets/"
                }
            }
        ]
    }
}