A build secret is mounted for one RUN and lands in no layer

A build argument is recorded in the image history whether or not it was used, so a token passed as ARG is readable by anybody who can pull the image.

# wrong
ARG COMPOSER_AUTH
RUN composer install

# right
RUN --mount=type=secret,id=composer_auth 
    COMPOSER_AUTH="$(cat /run/secrets/composer_auth)" 
    composer install --no-dev

# and the assertion, as a pipeline step
$ docker history --no-trunc app:build | grep -ciE 'token|auth|password'
0

The secret is mounted into a tmpfs for the duration of one RUN and appears in no layer, which is the only correct way to give a build a credential. The grep over the history belongs in CI rather than in a habit, because the failure mode is a token that is harmless until the image is pushed somewhere with wider access.