How do I build a Docker image without accidentally including secrets?
A Docker build can send the selected context to a builder and execute the Dockerfile’s instructions. Review that context before starting. Private keys, environment files, customer exports and other secrets do not belong in an image; deleting a copied secret in a later layer does not make the earlier layer safe.
Before you start
- A trusted Dockerfile and reviewed source directory.
- An approved image tag and build process.
- Resource capacity for a build without disrupting production workloads.
Instructions
1. Review the context and ignore rules
Use the narrow source directory required for the application. Review its .dockerignore and Dockerfile COPY instructions. Supply build credentials through the approved build-secret mechanism, not persistent ENV or ordinary build arguments.
2. Build a separately tagged review image
The example creates a new review tag and does not replace an existing running container. Replace the source path with the reviewed context; its Dockerfile can still run downloads and build commands.
docker build --tag example-app:review /srv/app/sourceBuilds the selected trusted context under a separate example image tag.
3. Record the resulting image and validate it
Inspect the built identity, then run the application’s tests and approved image scanning in the intended pipeline. A successful build is not proof that the application starts correctly or contains no vulnerabilities.
docker image inspect --format '{{.Id}}' example-app:reviewReports the built image identifier without dumping its entire configuration.
Check the result
- The image is built from reviewed inputs, has passed the application’s checks and uses an approved immutable reference for deployment.
Troubleshooting
- A secret was included in a build
- Treat the exposed value as compromised, rotate it through the authorised owner and rebuild from a clean context. Merely deleting it in a subsequent layer is insufficient.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.