# BuildKit secret mounts

**Project:** Applications | **Board:** Live | **Votes:** 1
**URL:** https://roadmap.ploi.cloud/projects/3-applications/items/172-buildkit-secret-mounts

---

It seems each build emits quite a few SecretsUsedInArgOrEnv warnings. 

So app secrets (APP_KEY, API keys) are passed as Docker ARGs, which can persist in image metadata/history. 

I know your registry is private, but BuildKit secret mounts (--mount=type=secret) would avoid baking them into layers at all. Might that be workable?

---

## Comments

**Zander van der Meer** (2026-09-11T10:00:10+00:00):
This has been solved now! 

**Steve Parks** (2026-09-11T15:04:20+00:00):
Hurray! Thanks Zander