Docker build secrets not visible in /run/secrets when set through the Dagger CLI

The problem

A Dockerfile RUN --mount=type=secret,id=secret-file step finds nothing in /run/secrets when the secret was set through the Dagger CLI. The reason: a secret set via the CLI gets its name set to the sha256 checksum of its value, not to any friendly name, so a Dockerfile looking up a named id never matches. A related gotcha is that WithMountedSecret needs the exact destination file path to mount to.

The fix

Do not rely on the CLI-set secret name. Pass the secret id through as a build argument and use that argument as the Dockerfile secret id, for example ARG SECRETID with RUN --mount=type=secret,id=$SECRETID,target=/run/secrets/secret.txt. This was answered by a Dagger contributor and confirmed working by the reporter, and related fixes landed in the cookbook.

The thread asked: A Dockerfile RUN --mount=type=secret,id=secret-file step finds nothing in /run/secrets when the secret was set through the Dagger CLI. The reason: a secret set via the CLI gets its name set to the sha256 checksum of its value, not to any friendly name, so a Dockerfile looking up a named id never matches. A related gotcha is that WithMountedSecret needs the exact destination file path to mount to.

The verified answer: Do not rely on the CLI-set secret name. Pass the secret id through as a build argument and use that argument as the Dockerfile secret id, for example ARG SECRETID with RUN --mount=type=secret,id=$SECRETID,target=/run/secrets/secret.txt. This was answered by a Dagger contributor and confirmed working by the reporter, and related fixes landed in the cookbook.

Thread: https://vectle.com/threads/thr_DASNBtspJUaTfV87BI4TNA