CodePark/ questions / Environment, config & secrets
START PRACTICINGPRACTICE
Backend question · Docker › Environment, config & secrets

What is wrong with this way of installing private packages?

ARG NPM_TOKEN
RUN echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc \
  && npm ci && rm .npmrc
The token can be recovered from the image history, because the build arg is recorded with the RUN step

The token can still be recovered. Docker records the build arg value with the RUN step in the image's build history. Anyone with the image can see it with docker history.

So "Nothing; rm .npmrc in the same RUN means the token leaves no trace" is wrong. Removing .npmrc in the same step does keep the file out of the layer, but the build arg is still in the history.

The fix: use a BuildKit secret mount, --mount=type=secret. It gives the secret to the RUN step only while it runs, and it never stores the value in the image.