What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use Docker BuildKit secret mounts for files, tokens, and passwords, and SSH mounts for agent sockets or SSH keys. Pass each credential only when you invoke the build, mount it in the single RUN instruction that needs it, and never place it in ARG, ENV, a copied file, or a logged command. BuildKit exposes a mounted secret temporarily, so it does not become part of the resulting image when the Dockerfile is written correctly.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
Why ordinary Docker variables leak credentials
A Docker build produces layers, metadata, logs, and often exported cache records. A password can therefore survive even when the final filesystem no longer contains the file that held it.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchARGandENVare persistent build metadata. Docker explicitly warns that build arguments and environment variables are inappropriate for secrets because they persist in the final image. Values may be visible through image inspection, configuration output, or build history.COPYcreates a layer. If a credential file is copied into a layer and deleted later, the earlier layer can still be obtained from the image or its cache.- Shell interpolation can expose values. A command that expands a secret into its command line may put the value in build logs or diagnostic output.
- Multi-stage builds are not a cleanup guarantee. Removing a credential from the final stage does not remove it from an intermediate layer, an exported cache, or a builder that retained that layer.
The risk is measurable: a 2023 arXiv study of 337,171 Docker Hub images found secrets in 8.5% of the sample, along with certificates and hosts associated with compromised keys. That percentage describes that sample and year; it is not a universal current rate, but it illustrates why build-time handling matters.
How BuildKit secret mounts work
A secret mount takes a credential from the build client and makes it available inside the build container only for the duration of one build instruction. BuildKit does not include the secret value in cache checksums, and the mounted file is not committed to the image filesystem when that instruction ends.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
The safe flow has two separate parts:
- Pass the credential to the builder with
--secret(or an SSH credential with--ssh). - Declare a narrowly scoped
RUN --mountin the Dockerfile and have the command read the mounted path directly.
You still have to protect the build environment. A shared builder, exported cache, CI logs, and the machine running the client can all access sensitive build-related data even though the secret value itself is excluded from the layer checksum.
Prerequisites and a safe starting configuration
Use a BuildKit-capable builder
Secret and SSH mounts require BuildKit. Recent Docker installations use it by default, while older setups may need Buildx or an explicitly selected BuildKit builder. Check the builder you will actually use in CI rather than assuming that your workstation’s configuration applies.
docker buildx ls
docker buildx inspect --bootstrapSelect or create a builder that reports a running BuildKit driver before relying on secret mounts. Pin a Dockerfile frontend that supports the options in your file:
# syntax=docker/dockerfile:1Pinning the frontend makes the Dockerfile’s mount syntax predictable when builders are upgraded.
Keep credentials outside the build context
The build context is every file sent to the builder. Do not put credential files in that directory. If a local credential must remain on disk nearby, exclude it with .dockerignore and verify the ignore rule before building.
.aws/
*.pem
*.key
.env
.env.*
credentials*Ignoring a file is a safeguard, not a substitute for keeping secrets elsewhere: a previously committed or copied credential may still exist in source-control history or an old context archive.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Safely mount a file secret
1. Pass the file at build time
Give the credential a clear, non-sensitive ID and point src at the file on the client:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
docker build
--secret id=aws,src="$HOME/.aws/credentials"
-t example-app:build .The same option is available with docker buildx build. The ID, unlike the file contents, may appear in build metadata, so use a descriptive name that does not contain the secret itself.
2. Consume it in one instruction
# syntax=docker/dockerfile:1
FROM alpine
RUN --mount=type=secret,id=aws
AWS_SHARED_CREDENTIALS_FILE=/run/secrets/aws
aws s3 cp s3://private-bucket/object /tmp/objectBy default, BuildKit presents the file at /run/secrets/<id>. The file exists only while this RUN executes. The command can read it, but a later instruction cannot access that mount unless it declares its own mount.
Use a different path or an environment variable when required
Some tools require a fixed filename. Set target to change the mount location:
RUN --mount=type=secret,id=license,target=/opt/tool/license.dat
/opt/tool/import-license /opt/tool/license.datBuildKit can also expose a secret as an environment variable with env, either instead of or alongside a file mount:
RUN --mount=type=secret,id=api_token,env=API_TOKEN
/usr/local/bin/fetch-private-dataUse this only when the tool genuinely requires an environment variable. An environment variable is available to every child process in that instruction, so a file path is usually easier to limit and audit. Never print the variable or include it in an error message.
Fail closed when a credential is missing
Add required=true when a successful build must have the credential:
RUN --mount=type=secret,id=api_token,required=true
/usr/local/bin/fetch-private-dataWithout this option, a missing secret can result in a confusing tool error or a build that silently skips a protected step.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Understand default permissions
On Linux, Docker documents default secret-file permissions of mode 0400, owner UID 0, and group GID 0. A non-root build user may therefore be unable to read the file. Set the mount’s uid, gid, or mode when the command needs different ownership:
RUN --mount=type=secret,id=config,target=/run/config,uid=1000,gid=1000,mode=0400
--mount=type=secret,id=config
/usr/local/bin/use-configDeclare a single mount with the desired options; the second declaration above is unnecessary and should not be copied. A typical usable form is:
RUN --mount=type=secret,id=config,target=/run/config,uid=1000,gid=1000,mode=0400
/usr/local/bin/use-configKeep the command in the same instruction as the mount. Copying the mounted file to a normal path would turn it into image data and defeat the protection.
Use SSH mounts for private Git access
SSH mounts are intended for an SSH agent socket or key-based access. They avoid placing a private key in the image and are the appropriate choice when a build must clone a private Git repository over SSH.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Forward an SSH agent
With an agent running on the build client, invoke:
docker buildx build --ssh default -t private-source-builder .Then request the agent socket only for the clone instruction:
# syntax=docker/dockerfile:1
FROM alpine AS source
RUN apk add --no-cache git openssh-client
RUN --mount=type=ssh
mkdir -p -m 0700 /root/.ssh &&
ssh-keyscan git.example.invalid >> /root/.ssh/known_hosts &&
git clone [email protected]:team/private-repo.git /srcUse host-key verification appropriate to your organization; do not disable verification merely to make a build pass. The SSH mount is present only for that instruction, and the agent can enforce its own key-use policy.
When a key file is unavoidable
BuildKit can forward an SSH key through the SSH mount, but an agent is generally easier to constrain and rotate. If a key file is supplied, ensure the client file permissions and CI secret handling are correct, and never copy the key into the image. Remove unnecessary repository metadata and credentials from the resulting artifact after the fetch.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Authenticate remote private Git contexts
There is a distinction between a command inside a build and BuildKit fetching the build context itself. For a remote private Git context or an ADD from a private repository, BuildKit provides predefined pre-flight secrets:
GIT_AUTH_TOKENsupplies a token. BuildKit documents a GitHub-stylex-access-tokenbasic-auth construction for this credential.GIT_AUTH_HEADERsupplies the rawAuthorizationheader value when the server expects a different format.
These credentials are used before the Dockerfile runs, while BuildKit retrieves the remote source. They are not a replacement for a RUN --mount=type=secret inside the Dockerfile. Configure the token for the host and invocation supported by your builder, and scope it to read-only repository access where possible.
Approaches to avoid
| Approach | Why it is unsafe | Safer replacement |
|---|---|---|
ARG PASSWORD=... |
The value can persist in image history and build metadata. | Use a secret mount and read the mounted file only in the needed instruction. |
ENV API_TOKEN=... |
The value becomes image configuration and is inherited by later processes. | Use env= on a secret mount only when the tool requires an environment variable. |
COPY credentials /root/.config |
The credential enters a filesystem layer; deleting it later does not erase that layer. | Mount the file temporarily from the client. |
Embedding a token in a RUN command |
Shell tracing, command logging, diagnostics, or failed-step output can reveal it. | Have the program read the mounted path or injected variable without echoing it. |
| Relying on multi-stage builds alone | Intermediate layers and caches may remain accessible even when the final image is clean. | Prevent the credential from entering any layer in the first place. |
BuildKit’s cache design excludes secret values from cache checksums. That prevents the credential itself from becoming a cache key, but it also means changing a secret does not necessarily invalidate a cached result. If the fetched artifact must be refreshed after rotation, use an explicit non-secret cache-busting strategy or run the affected build with --no-cache. Never put the secret value into an invalidation argument.
Build-cache and shared-builder controls
Treat cache storage as sensitive infrastructure. A cache may contain source material, generated packages, or an intermediate result created by a command that had access to a secret, even if the secret value is not included in the checksum.
- Restrict who can read and export build caches.
- Do not publish caches from a private build to an untrusted registry or shared builder.
- Separate builders and cache namespaces for projects with different trust levels.
- Review CI settings that upload build logs, failed workspaces, temporary directories, and cache archives.
- Use least-privilege credentials that can read only the required object, package, or repository.
For reproducibility, record the secret ID, mount target, and command’s intended input without recording the credential value. This gives reviewers enough information to audit scope while keeping the sensitive material out of source control.
Free tools Windows power users keep installed
One-click scans. No signup required.
Linux and Windows container differences
On Linux, a secret mount normally appears as a temporary file with configurable mode, UID, and GID. Windows containers have different documented behavior:
- The secret is a read-only, single-file bind mount.
- An explicit
targetis required. mode,uid, andgidare ignored.- The temporary file is ACL-restricted.
- A step may need to run as
ContainerAdministratorto read it.
Test the exact Windows base image and user configuration in the same type of builder used by CI. A Dockerfile that works as root on Linux can fail because the Windows process identity cannot access the target file.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Choosing the right mount
| Need | Recommended mechanism | Exposure scope | Main checks |
|---|---|---|---|
| Configuration file, certificate, package credential, or API token read from a file | type=secret file mount |
One RUN instruction |
Correct ID, target, permissions, and no copy to a normal path |
| Tool requires a token in an environment variable | type=secret with env= |
One RUN instruction and its child processes |
No shell tracing, logging, or process output containing the value |
| Private Git clone over SSH | type=ssh with --ssh |
One RUN instruction |
Agent policy, host-key verification, and repository read scope |
| Remote private Git context or private source fetched before the Dockerfile runs | Pre-flight GIT_AUTH_TOKEN or GIT_AUTH_HEADER |
Context-fetch phase | Correct authorization format, host mapping, and token scope |
Troubleshooting common failures
“Unknown flag: mount” or the secret path is absent
The selected builder may not be using BuildKit, or the Dockerfile frontend is too old. Inspect the active builder with Buildx, bootstrap it, and keep the syntax directive at the top of the Dockerfile. Make sure the build command and the builder you inspected are the same ones used in CI.
The command says the file does not exist
Check that the invocation’s ID exactly matches id= in the Dockerfile. Unless target is set, use /run/secrets/<id>. Also verify that the source path exists on the client and that the secret was passed to the build command rather than merely defined in the shell.
The tool reports permission denied
On Linux, the default file is root-owned and mode 0400. Run the consuming command with an appropriate user or set uid, gid, and mode on the mount. On Windows, verify the container user and ACL requirements instead; Linux permission options do not apply there.
A private clone fails during a build
Use an SSH mount for an SSH URL and pass --ssh. Confirm that the agent has the expected key, the repository host is in known_hosts, and the key can read the repository. For an HTTPS remote context, configure the appropriate pre-flight Git authentication secret rather than expecting a Dockerfile secret mount to authenticate the context fetch.
A rotated credential still appears to produce old data
Because secret values are excluded from cache checksums, an old successful result may be reused. Rebuild the affected step with --no-cache or another documented, non-secret invalidation input, and inspect the cache policy if the output should never be reused across credential changes.
A secret appears in history or logs
Stop distributing the image or logs, revoke and rotate the credential immediately, and investigate every copy: image history, intermediate layers, registry cache, CI artifacts, workspaces, and log aggregation. Rewriting the Dockerfile does not remove an already published layer or log record.
Recommended Free Tools
CI/CD operating procedure
- Store the credential in the CI secret store or an agent. Do not commit it, place it in the build context, or write it to a generated Dockerfile.
- Pass it at invocation time. Use
--secretfor files or token values and--sshfor an agent socket. - Mount it in the smallest possible scope. Put the mount on the one
RUNinstruction that needs it, not on a broad setup step. - Make absence explicit. Use
required=truefor mandatory credentials so the build fails early. - Prevent accidental output. Disable shell tracing around the command, avoid verbose modes that print authorization headers, and review failed-build logs.
- Limit the credential. Prefer read-only repository, package, or object permissions and a short expiration where the provider supports it.
- Control builders and caches. Restrict access, isolate projects, and treat exported cache records as sensitive.
- Test the resulting image. Inspect image configuration and history for credential names or values, scan layers and CI artifacts, and confirm that the final filesystem contains only the intended downloaded output.
Incident response when a build secret leaked
Assume a credential is compromised if it appeared in an argument, environment variable, copied file, command output, image layer, intermediate stage, or shared cache. The order of response matters:
- Revoke or rotate the credential at its issuer before attempting cleanup.
- Identify every image tag, digest, cache export, log, artifact, and registry that may contain it.
- Restrict access to those records and remove them according to your retention and registry policies.
- Rebuild from a clean context using a secret or SSH mount and a new credential.
- Audit access logs for use of the old credential and document the affected scope.
Deleting a tag is not the same as deleting an immutable layer or a cache export. Treat all copies as exposed until the issuer confirms revocation and the storage systems confirm removal or expiration.
Quick Recap
Practical review checklist
- Is the builder BuildKit-capable, and is the Dockerfile frontend pinned?
- Does each secret have a clear ID passed only by
--secret,--ssh, or the documented Git pre-flight mechanism? - Is the mount attached only to the instruction that needs it?
- Does the command read the mounted path without copying it elsewhere?
- Are
ARG,ENV, and credential-bearingCOPYinstructions absent? - Are credential files excluded from the build context and source-control history?
- Are logs, shell tracing, failed workspaces, caches, and exported layers protected?
- Do Linux ownership settings or Windows ACL behavior match the process that reads the file?
- Is the credential least-privilege and easy to rotate?
- Has the final image and its build metadata been checked for accidental disclosure?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
