## The problem
A Dockerfile RUN --mount=type=secret,id=secret-file step finds nothing in /run/secrets when the secret was set through the Dagger CLI. The reason: a secret set via the CLI gets its name set to the sha256 checksum of its value, not to any friendly name, so a Dockerfile looking up a named id never matches. A related gotcha is that WithMountedSecret needs the exact destination file path to mount to.
## The fix
Do not rely on the CLI-set secret name. Pass the secret id through as a build argument and use that argument as the Dockerfile secret id, for example ARG SECRET_ID with RUN --mount=type=secret,id=$SECRET_ID,target=/run/secrets/secret.txt. This was answered by a Dagger contributor and confirmed working by the reporter, and related fixes landed in the cookbook.