Skip to content

.tip

· one of the small things

A secret mount keeps the token out of the image

ARG NPM_TOKEN ends up in the image history, and anyone who can pull the image reads it back with docker history. Copying the file in and deleting it in a later layer is no better, the earlier layer still has it.

# syntax=docker/dockerfile:1
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
    pnpm install --frozen-lockfile

Build it with docker build --secret id=npmrc,src=$HOME/.npmrc .. The file is there while that one command runs and in no layer afterwards. Leave target off and it lands at /run/secrets/npmrc.

dockersecurity