RUN --mount=type=secret
This mount type allows the build container to access secret values, such as
tokens or private keys, without baking them into the image.
By default, the secret is mounted as a file. You can also mount the secret as
an environment variable by setting theenvoption.
The following example takes the secretAPI_KEYand mounts it as an
environment variable with the same name.
Assuming that theAPI_KEYenvironment variable is set in the build
environment, you can build this with the following command: