<p>Is it possible to <strong>access machine environments inside dockerfile</strong>? I was thinking passing the SECRET as build ARG, like so:</p>
<p>docker-compose:</p>
<pre class="lang-yaml prettyprint-override"><code>version: '3.5'
services:
  service:
    ...
    build:
      ...
      args:
        SECRET: ${SECRET}
    ...
</code></pre>
<p>dockerfile:</p>
<pre><code>FROM image
ARG SECRET
RUN script-${SECRET}

</code></pre>
<p><em>Note:</em> the container is build in kubernetes, I can not pass any arguments to the build command or perform any command at all.</p>
<p><em>Edit 1:</em> It is okay to pass SECRET as ARG because this is not sensitive data. I'm using SECRETS to access micro service data, and I can only store data using secrets. Think of this as machine environment.</p>
<p><em>Edit 2:</em> This was not a problem with docker but with the infrastructure that I was working with which does not allow any arguments to be passed to the docker build.</p>

<p>The secrets should be used during run time and provided by execution environment.</p>
<p>Also everything that is executing during a container build is written down as layers and available later to anyone who is able to get access to an image. That's why it's hard to consume secrets during the build in a secure way.</p>
<p>In order to address this, Docker recently introduced <a href="https://docs.docker.com/develop/develop-images/build_enhancements/#new-docker-build-secret-information" rel="noreferrer">a special option <code>--secret</code></a>. To make it work, you will need the following:</p>
<ol>
<li><p>Set environment variable <em>DOCKER_BUILDKIT=1</em></p>
</li>
<li><p>Use the <em>--secret</em> argument to <em>docker build</em> command</p>
<p><code>DOCKER_BUILDKIT=1 docker build --secret id=mysecret,src=mysecret.txt</code>...</p>
</li>
<li><p>Add a <em>syntax</em> comment to the very top of your Docker file</p>
<p><code># syntax = docker/dockerfile:1.0-experimental</code></p>
</li>
<li><p>Use the <em>--mount</em> argument to mount the secret for every <em>RUN</em> directive that needs it</p>
</li>
</ol>
<p><code>RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret</code></p>
<p>Please note that this needs <a href="https://docs.docker.com/develop/develop-images/build_enhancements/#new-docker-build-secret-information" rel="noreferrer">Docker version 18.09 or later</a>.</p>
