Docker and CI/CD · Middle · Question 10 of 75

How do you use an npm token during a build without leaving it in the image?

1Copy .npmrc in and remove it in the next RUN
✓Correct answer: Mount it as a build secret: RUN --mount=type=secret,id=npm ...
3Pass it with ARG NPM_TOKEN and delete it at the end

Explanation

Build secrets are available only during that RUN and never written to a layer. ARG values and copied files end up in the image history.

Further reading

Docker Docs: Build secrets ↗

Test yourself

Take the Docker and CI/CD · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.