Dunia D2: Resepi

Cache mount BuildKit dan rahsia binaan

Anda akan belajar: pinjamkan kunci kepada satu langkah build, dan simpan muat turun di rak antara build.

Teks BM belum disemak oleh penutur asli.

Disemak dengan Docker Engine 29 pada 31 Okt 2026

Masalahnya

~/api $ cat leak/DockerfileFROM node:24-alpineARG NPM_TOKENWORKDIR /appCOPY package.json package-lock.json .npmrc ./RUN npm ci~/api $ docker build --build-arg NPM_TOKEN=test-token-123 -t leaky:1.0 leak[+] Building 1.3s (9/9) FINISHED                                  docker:default => [internal] load build definition from Dockerfile                        0.0s => => transferring dockerfile: 141B                                        0.0s => WARN: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "NPM_TOKEN") (line 2) => [internal] load metadata for docker.io/library/node:24-alpine           0.0s => [internal] load .dockerignore                                           0.0s => => transferring context: 2B                                             0.0s => [1/4] FROM docker.io/library/node:24-alpine@sha256:8a32c8cf649a49915a6  0.0s => => resolve docker.io/library/node:24-alpine@sha256:8a32c8cf649a49915a6  0.0s => [2/4] WORKDIR /app                                                      0.0s => [internal] load build context                                           0.0s => => transferring context: 440B                                           0.0s => [3/4] COPY package.json package-lock.json .npmrc ./                     0.0s => [4/4] RUN npm ci                                                        1.2s => exporting to image                                                      0.1s => => exporting layers                                                     0.0s => => exporting manifest sha256:4c73b400576cc77a016e760ef3fcbce67b7d3bf3b  0.0s => => exporting config sha256:d000b0c253b132cb99495b392d60885a04b9966d8f5  0.0s => => exporting attestation manifest sha256:6a24dc7aad53822397d4f7f01c8b1  0.0s => => exporting manifest list sha256:42510cfdc9365bb60bc40b94ff193fee572b  0.0s => => naming to docker.io/library/leaky:1.0                                0.0s => => unpacking to docker.io/library/leaky:1.0                             0.0s 1 warning found (use docker --debug to expand): - SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "NPM_TOKEN") (line 2)~/api $ docker history leaky:1.0IMAGE          CREATED         CREATED BY                                      SIZE      COMMENT42510cfdc936   3 seconds ago   RUN |1 NPM_TOKEN=test-token-123 /bin/sh -c n…   12.3kB    buildkit.dockerfile.v0<missing>      3 seconds ago   COPY package.json package-lock.json .npmrc .…   20.5kB    buildkit.dockerfile.v0<missing>      3 seconds ago   WORKDIR /app                                    8.19kB    buildkit.dockerfile.v0<missing>      3 seconds ago   ARG NPM_TOKEN=test-token-123                    0B        buildkit.dockerfile.v0<missing>      2 days ago      CMD ["node"]                                    0B        buildkit.dockerfile.v0<missing>      2 days ago      ENTRYPOINT ["docker-entrypoint.sh"]             0B        buildkit.dockerfile.v0<missing>      2 days ago      COPY docker-entrypoint.sh /usr/local/bin/ # …   20.5kB    buildkit.dockerfile.v0<missing>      2 days ago      RUN /bin/sh -c apk add --no-cache --virtual …   5.48MB    buildkit.dockerfile.v0<missing>      2 days ago      ENV YARN_VERSION=1.22.22                        0B        buildkit.dockerfile.v0<missing>      2 days ago      RUN /bin/sh -c addgroup -g 1000 node     && …   167MB     buildkit.dockerfile.v0<missing>      2 days ago      ENV NODE_VERSION=24.22.2                        0B        buildkit.dockerfile.v0<missing>      9 days ago      CMD ["/bin/sh"]                                 0B        buildkit.dockerfile.v0<missing>      9 days ago      ADD alpine-minirootfs-3.24.3-x86_64.tar.gz /…   9.08MB    buildkit.dockerfile.v0

Token diberi melalui ARG. Build beri amaran SecretsUsedInArgOrEnv. docker history kemudian tunjuk NPM_TOKEN=test-token-123 pada dua baris. Transkrip Docker: $ cat leak/Dockerfile FROM node:24-alpine ARG NPM_TOKEN WORKDIR /app COPY package.json package-lock.json .npmrc ./ RUN npm ci $ docker build --build-arg NPM_TOKEN=test-token-123 -t leaky:1.0 leak [+] Building 1.3s (9/9) FINISHED docker:default => [internal] load build definition from Dockerfile 0.0s => => transferring dockerfile: 141B 0.0s => WARN: SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "NPM_TOKEN") (line 2) => [internal] load metadata for docker.io/library/node:24-alpine 0.0s => [internal] load .dockerignore 0.0s => => transferring context: 2B 0.0s => [1/4] FROM docker.io/library/node:24-alpine@sha256:8a32c8cf649a49915a6 0.0s => => resolve docker.io/library/node:24-alpine@sha256:8a32c8cf649a49915a6 0.0s => [2/4] WORKDIR /app 0.0s => [internal] load build context 0.0s => => transferring context: 440B 0.0s => [3/4] COPY package.json package-lock.json .npmrc ./ 0.0s => [4/4] RUN npm ci 1.2s => exporting to image 0.1s => => exporting layers 0.0s => => exporting manifest sha256:4c73b400576cc77a016e760ef3fcbce67b7d3bf3b 0.0s => => exporting config sha256:d000b0c253b132cb99495b392d60885a04b9966d8f5 0.0s => => exporting attestation manifest sha256:6a24dc7aad53822397d4f7f01c8b1 0.0s => => exporting manifest list sha256:42510cfdc9365bb60bc40b94ff193fee572b 0.0s => => naming to docker.io/library/leaky:1.0 0.0s => => unpacking to docker.io/library/leaky:1.0 0.0s 1 warning found (use docker --debug to expand): - SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "NPM_TOKEN") (line 2) $ docker history leaky:1.0 IMAGE CREATED CREATED BY SIZE COMMENT 42510cfdc936 3 seconds ago RUN |1 NPM_TOKEN=test-token-123 /bin/sh -c n… 12.3kB buildkit.dockerfile.v0 <missing> 3 seconds ago COPY package.json package-lock.json .npmrc .… 20.5kB buildkit.dockerfile.v0 <missing> 3 seconds ago WORKDIR /app 8.19kB buildkit.dockerfile.v0 <missing> 3 seconds ago ARG NPM_TOKEN=test-token-123 0B buildkit.dockerfile.v0 <missing> 2 days ago CMD ["node"] 0B buildkit.dockerfile.v0 <missing> 2 days ago ENTRYPOINT ["docker-entrypoint.sh"] 0B buildkit.dockerfile.v0 <missing> 2 days ago COPY docker-entrypoint.sh /usr/local/bin/ # … 20.5kB buildkit.dockerfile.v0 <missing> 2 days ago RUN /bin/sh -c apk add --no-cache --virtual … 5.48MB buildkit.dockerfile.v0 <missing> 2 days ago ENV YARN_VERSION=1.22.22 0B buildkit.dockerfile.v0 <missing> 2 days ago RUN /bin/sh -c addgroup -g 1000 node && … 167MB buildkit.dockerfile.v0 <missing> 2 days ago ENV NODE_VERSION=24.22.2 0B buildkit.dockerfile.v0 <missing> 9 days ago CMD ["/bin/sh"] 0B buildkit.dockerfile.v0 <missing> 9 days ago ADD alpine-minirootfs-3.24.3-x86_64.tar.gz /… 9.08MB buildkit.dockerfile.v0

Laptop anda`~/api`

Tiada tingkap terbuka

Bekas (container)

Belum ada container

Pek beku (image)

node:24-alpine4 layer · 244MB

Anda beri token npm melalui ARG. Build pun sudah beri amaran: SecretsUsedInArgOrEnv. Sekarang tengok docker history: sesiapa yang ada image boleh baca token itu!

Tengok

Ketik baris yang meminjam kunci.

0 daripada 1 dijumpai

ialah kunci yang dipinjamkan kepada satu langkah RUN. Bila langkah itu tamat, kunci itu dipulangkan. Tiada layer (lapisan) yang menyimpannya.

Cuba

Bina resepi selamat ini sebagai api:1.0. Cuba cara biasa dulu dan baca ralatnya. Kemudian pinjamkan kunci dari token.txt.

Laptop anda`~/api`

Tiada tingkap terbuka

Bekas (container)

Belum ada container

Pek beku (image)

node:24-alpine4 layer · 244MB

Petunjuk

--secret id=npm_token,src=token.txt pinjamkan isi fail itu sebagai rahsia.

Cuba

Muat turun pun lambat. ialah rak dapur yang BuildKit simpan antara build. Ia tiada dalam image. Bina baris RUN yang menggunakannya.

Ketik kepingan ikut turutan yang betul.

…

Teka

Anda bina api:1.0 dengan rahsia itu. Adakah docker history api:1.0 tunjuk test-token-123?

Semak

~/api $ docker build --secret id=npm_token,src=token.txt -t api:1.0 .[+] Building 1.3s (9/9) FINISHED                                  docker:default => [internal] load build definition from Dockerfile                        0.0s => => transferring dockerfile: 188B                                        0.0s => [internal] load metadata for docker.io/library/node:24-alpine           0.0s => [internal] load .dockerignore                                           0.0s => => transferring context: 63B                                            0.0s => [stage-0 1/4] FROM docker.io/library/node:24-alpine@sha256:8a32c8cf649  0.0s => => resolve docker.io/library/node:24-alpine@sha256:8a32c8cf649a49915a6  0.0s => [stage-0 2/4] WORKDIR /app                                              0.0s => [internal] load build context                                           0.0s => => transferring context: 1.36kB                                         0.0s => [stage-0 3/4] COPY package.json package-lock.json .npmrc ./             0.0s => [stage-0 4/4] RUN --mount=type=secret,id=npm_token,env=NPM_TOKEN,requi  1.2s => exporting to image                                                      0.1s => => exporting layers                                                     0.0s => => exporting manifest sha256:1e0b185043c5b0e3ec77a756772be38228be383a8  0.0s => => exporting config sha256:71735dabf55c103ca3da2416b3657a5985707beb3fe  0.0s => => exporting attestation manifest sha256:be6e365c920e71bb58732791f0f63  0.0s => => exporting manifest list sha256:a70ce11917463782f0673f37116c9d18467e  0.0s => => naming to docker.io/library/api:1.0                                  0.0s => => unpacking to docker.io/library/api:1.0                               0.0s~/api $ docker history --format "{{.CreatedBy}}" api:1.0RUN /bin/sh -c npm ci # buildkitCOPY package.json package-lock.json .npmrc .…WORKDIR /appCMD ["node"]ENTRYPOINT ["docker-entrypoint.sh"]COPY docker-entrypoint.sh /usr/local/bin/ # …RUN /bin/sh -c apk add --no-cache --virtual …ENV YARN_VERSION=1.22.22RUN /bin/sh -c addgroup -g 1000 node     && …ENV NODE_VERSION=24.22.2CMD ["/bin/sh"]ADD alpine-minirootfs-3.24.3-x86_64.tar.gz /…

Laptop anda`~/api`

Tiada tingkap terbuka

Bekas (container)

Belum ada container

Pek beku (image)

node:24-alpine4 layer · 244MB

Tiada token di mana-mana. Layer RUN cuma tulis npm ci. token.txt ada dalam .dockerignore juga, jadi ia tak pernah sampai ke dapur.

Semak

Selamat? Leret ke kanan untuk ya, ke kiri untuk “perlu dibaiki”.

Leret ke kanan untuk bagus, ke kiri untuk perlu baiki. Atau guna butang.

1 / 5

Beri token npm melalui --build-arg

Anda berjaya!

Kini anda boleh pinjamkan rahsia dan simpan muat turun di rak.

Nak tahu lebih (pilihan)

Tanpa env=, rahsia itu jadi fail di /run/secrets/<id>. Tanpa required=true, rahsia yang tiada cuma tak muncul. Rahsia tak ubah cache: token baharu tak bakar semula. Guna token ujian sahaja semasa berlatih.

Misi sebenar

Letak token palsu dalam token.txt dan senaraikannya dalam .dockerignore.
Tambah baris RUN --mount=type=secret yang cuma semak rahsia itu wujud.
RUN --mount=type=secret,id=demo test -f /run/secrets/demo
Bina dengan rahsia itu.
docker build --secret id=demo,src=token.txt -t demo:1.0 .
Semak docker history. Tiada token!

0 daripada 4 langkah siap · Tanda anda disimpan.

Cache mount BuildKit dan rahsia binaan

Laptop anda~/api

Bekas (container)

Pek beku (image)

Laptop anda~/api

Bekas (container)

Pek beku (image)

Laptop anda~/api

Bekas (container)

Pek beku (image)

Laptop anda`~/api`

Laptop anda`~/api`

Laptop anda`~/api`