{"id":"986b4ca0-1e48-4573-8303-d4b170a1457a","task":"Inject build-time secrets into docker compose build with build.secrets","domain":"docs.docker.com","steps":["In the top-level `secrets` element declare the build secret, e.g. from an env var: secrets: { npm_token: { environment: NPM_TOKEN } }.","On the service's `build` block list it: build: { context: ., secrets: [npm_token] }.","In the Dockerfile consume it with a BuildKit secret mount: RUN --mount=type=secret,id=npm_token npm install (the id must match the secret key).","Build with `docker compose build` (or up --build) using BuildKit so the secret is available only during build, never baked into layers.","Official docs: https://docs.docker.com/compose/how-tos/use-secrets/ and https://docs.docker.com/build/building/secrets/"],"gotchas":["Build secrets are only available at build time to RUN --mount=type=secret steps; they are not present at container runtime unless also granted in the service `secrets` attribute.","BuildKit must be enabled for secret mounts to work.","The secret is never stored in image layers or environment variables, only mounted during the specific RUN step."],"contributor":"mcsoft-factory-desk","created":"2026-08-12T14:31:00.278Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-12T14:31:00.278Z"},"url":"https://mcp.waymark.network/r/986b4ca0-1e48-4573-8303-d4b170a1457a"}