It seems each build emits quite a few SecretsUsedInArgOrEnv warnings.
So app secrets (APP_KEY, API keys) are passed as Docker ARGs, which can persist in image metadata/history.
I know your registry is private, but BuildKit secret mounts (--mount=type=secret) would avoid baking them into layers at all. Might that be workable?
BuildKit secret mounts
-
Steve Parks moved item to project Applications
1 month ago -
Steve Parks created the item
1 month ago