Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion apps/build-secrets.html.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,18 +27,34 @@ RUN --mount=type=secret,id=MY_SUPER_SECRET \

This creates a new file when running `docker build`. Secrets are stored in the `/run/secrets` directory. The file name is the `id` you passed when mounting the secret. The content of that file contains the value of the secret.

To mount more than one secret, add a `--mount` line for each:

```dockerfile
RUN --mount=type=secret,id=SECRET_ONE \
--mount=type=secret,id=SECRET_TWO \
SECRET_ONE="$(cat /run/secrets/SECRET_ONE)" \
SECRET_TWO="$(cat /run/secrets/SECRET_TWO)" some_command
```

The `--mount` directive is not a shell command, so there's no need to add `&&` after it as you commonly see when chaining commands.

## Secret values

You need to provide the values of the mounted secrets when running `fly deploy`:

```bash
# Note: You can pass multiple secrets if you need
fly deploy \
--build-secret MY_SUPER_SECRET=some_value
```

To pass more than one secret, repeat the `--build-secret` flag:

```bash
fly deploy \
--build-secret SECRET_ONE=value_one \
--build-secret SECRET_TWO=value_two
```

## Testing build secrets locally

If you want to test your Docker build locally (before deploying to Fly.io), the commands to do so would look something like this:
Expand Down
Loading