Q: During a routine compliance audit, a security researcher ran `docker history --no-trunc` against your production customer-facing API container and discovered raw GitHub Personal Access Tokens and AWS secret keys embedded in cleartext in the layer metadata. Developers used `ARG GITHUB_TOKEN` and `ENV AWS_SECRET` to download private npm packages and S3 config files during image builds. You must eliminate all secret leakage anti-patterns and mandate secure BuildKit secret mounts and SSH agent forwarding.

Understand why common workarounds fail: `ENV` persists variables permanently into runtime containers. `ARG` values are stored in plaintext inside the image configuration JSON and layer history. Even deleting the secret in a later multi-stage build does not prevent the secret from being extracted from intermediate cache layers or build logs.

# INSECURE ANTI-PATTERNS:
# Anti-pattern 1: ARG leaks into docker history
ARG GITHUB_TOKEN
RUN git clone https://$GITHUB_TOKEN@github.com/myorg/private-repo.git

# Anti-pattern 2: ENV persists in final container environment
ENV AWS_SECRET_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE

Use BuildKit's `--mount=type=secret` syntax. Secrets are exposed to a single `RUN` command as a temporary in-memory file (`/run/secrets/`) and are completely excluded from layer diffs and image metadata.

# syntax=docker/dockerfile:1.7
FROM node:20-alpine
WORKDIR /app
COPY package.json package-lock.json ./

# Securely mount secret for npm authentication
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
    npm ci --omit=dev

COPY . .
CMD ["node", "index.js"]

To clone private Git repositories during build without copying SSH keys into the Docker context, use `--mount=type=ssh` to forward the local host's SSH agent directly to the builder.

# Dockerfile
FROM alpine:3.19
RUN apk add --no-cache openssh-client git
RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan github.com >> ~/.ssh/known_hosts

# Clone private repository using host's SSH agent
RUN --mount=type=ssh git clone git@github.com:myorg/core-lib.git /lib

# CLI Invocation:
# eval $(ssh-agent) && ssh-add ~/.ssh/id_rsa
# docker build --ssh default -t my-secure-app .

Verify that neither `docker history` nor `docker inspect` contains any secret artifacts, and that `/run/secrets` does not exist in the finished container image.

# Inspect layers for leaked secrets
docker history --no-trunc my-secure-app:latest | grep -i npmrc
# Output: Zero matches!

# Inspect container filesystem to verify secret directory is absent
docker run --rm my-secure-app:latest ls -la /run/secrets
# Output: ls: /run/secrets: No such file or directory