A secret mount is not an ARG, and history proves it

A build argument is recorded in the image history whether or not the build used it, so a token passed as an ARG is readable by anybody who can pull the image.

# wrong
ARG COMPOSER_AUTH
RUN composer install

# right
RUN --mount=type=secret,id=composer_auth 
    COMPOSER_AUTH="$(cat /run/secrets/composer_auth)" 
    composer install --no-dev

# and the check, which belongs in CI
$ docker history --no-trunc app:build | grep -ci 'token|auth'
0

The secret is mounted into a tmpfs for the duration of one RUN and appears in no layer, which is the only correct way to give a build a credential. The grep over docker history is worth having as a pipeline step rather than a habit, because the failure mode is a token that is fine until the image is pushed somewhere with wider access. It requires BuildKit, which in 2021 still means setting DOCKER_BUILDKIT=1 on some hosts.