In general your secrets should expose the minimum access needed for the actions to be performed. For a docker build that'd likely be reading rather than writing

In general your secrets should expose the minimum access needed for the actions to be performed. For a docker build that'd likely be reading rather than writing data. Short term rotated credentials over long term credentials. The goal is defense in depth so that even if a secret is leaked the damage is minimal.