A build secret that was in the image, in a layer, in the history

A token passed as a build argument, removed in a later layer, and present in the image history for anybody who pulls it.

# the leak
ARG COMPOSER_AUTH
RUN composer install && unset COMPOSER_AUTH
# ARG values are recorded in the image metadata. the
# unset does nothing.

# the fix
RUN --mount=type=secret,id=composer_auth 
    COMPOSER_AUTH="$(cat /run/secrets/composer_auth)" 
    composer install

A secret mount is available during the RUN and is not in any layer or in the metadata, which is the only correct way to pass one into a build. Checking is one command — docker history --no-trunc — and it is worth running against any image that was built before you knew this, because the token stays valid until somebody rotates it.