It seems each build emits quite a few SecretsUsedInArgOrEnv warnings.
So app secrets (APP_KEY, API keys) are passed as Docker ARGs, which can persist in image metadata/history.
I know your registry is private, but BuildKit secret mounts (--mount=type=secret) would avoid baking them into layers at all. Might that be workable?
BuildKit secret mounts
-
Zander van der Meer moved item to board Live
1 month ago -
Dennis moved item to board Planned
1 month ago -
Steve Parks moved item to project Applications
2 months ago -
Steve Parks created the item
2 months ago