What Is a Build Secret Mount?

A build secret mount is a BuildKit feature that makes a secret available to a specific build step as a temporary file or environment value, without writing it into a layer. The secret is mounted only while that step runs and never persists in the image or the build cache. It is the safe way to use a token during a build.

Why it matters

Passing secrets via build arguments or copying them in leaks them into image history where anyone with the image can extract them. A secret mount keeps the credential out of all layers and cache entries, so the published image is clean. This matters most for private package tokens needed only at build time.

Related guides