Clean room builds. Set up an environment with no access to anything (other than a NAT gateway). Copy only the files needed to do the build into the environment.

Clean room builds. Set up an environment with no access to anything (other than a NAT gateway). Copy only the files needed to do the build into the environment. Run the build. At the end of the build, capture the artifacts. Tear it all down at the end. For a Docker container, that might look like: 1. Create an EC2 instance with no IAM permissions, and a user with ~/.ssh/authorized_keys to allow copying in files. 2. Install Docker. 3. Copy all files for your build to the host. Make sure not to copy any secrets (!). 4. Run the 'docker build'. 5. Set up remote registry authentication. 6. 'docker push' the built image to the remote registry. In that environment, the only "secrets" you can bring along into the container came when you copied files to the EC2 instance (which shouldn't have been there, just like secrets shouldn't be in your source code). So then you also make sure the process that preps your files for copying also contains no secrets.