Skip to content

Commit 292d433

Browse files
committed
Simplify secret mount explanation with cross-reference
Replace detailed explanation of secret mount behavior with brief callout that cross-references the canonical Build secrets documentation. This avoids duplicating content that's already covered in detail at /manuals/build/building/secrets.md and keeps the GitHub Actions page focused on the GitHub Actions-specific usage patterns. Assisted-By: docker-agent
1 parent cc94696 commit 292d433

1 file changed

Lines changed: 6 additions & 45 deletions

File tree

content/manuals/build/ci/github-actions/secrets.md

Lines changed: 6 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -57,51 +57,12 @@ jobs:
5757
"github_token=${{ secrets.GITHUB_TOKEN }}"
5858
```
5959
60-
### How secrets appear in the build container
61-
62-
When you use a secret mount, the secret is made available as a file inside the build container.
63-
By default, secrets are mounted to `/run/secrets/<id>`, where `<id>` is the secret identifier
64-
you specify in the `--mount` instruction.
65-
66-
For more details on secret mounts, file locations, and permissions,
67-
see [Secret mounts](/manuals/build/building/secrets.md#secret-mounts).
68-
69-
**File location:**
70-
71-
- Default path: `/run/secrets/<id>` (for example, `/run/secrets/github_token`)
72-
- Custom path: Use the `target` option to specify a different location
73-
74-
**Environment variable secrets:**
75-
76-
When you use the `env` option in your secret mount
77-
(like `--mount=type=secret,id=github_token,env=GITHUB_TOKEN`),
78-
the secret file content is automatically loaded into the specified environment variable.
79-
This is useful when tools expect credentials via environment variables rather than files.
80-
81-
**Example with custom target:**
82-
83-
```dockerfile
84-
# syntax=docker/dockerfile:1
85-
FROM alpine
86-
# Mount secret to a custom location and use it with curl
87-
RUN --mount=type=secret,id=github_token,target=/tmp/token \
88-
curl -H "Authorization: token $(cat /tmp/token)" https://api.github.com/user
89-
```
90-
91-
**Example using secret as environment variable:**
92-
93-
```dockerfile
94-
# syntax=docker/dockerfile:1
95-
FROM alpine
96-
# Load secret into environment variable
97-
RUN --mount=type=secret,id=github_token,env=GITHUB_TOKEN \
98-
curl -H "Authorization: token ${GITHUB_TOKEN}" https://api.github.com/user
99-
```
100-
101-
> [!WARNING]
102-
> Never use commands like `cat`, `echo`, or `printenv` to output secret values directly,
103-
> as this would expose them in build logs and layer history.
104-
> Always consume secrets within commands without displaying their values.
60+
> [!NOTE]
61+
> Secrets are mounted as files in the build container.
62+
> By default, they're available at `/run/secrets/<id>`.
63+
> You can also use the `env` option to load a secret into an environment variable,
64+
> or the `target` option to customize the mount path.
65+
> For details on secret mounts, see [Build secrets](/manuals/build/building/secrets.md).
10566

10667
### Using secret files
10768

0 commit comments

Comments
 (0)