For Go, I also take the vendor approach. But for other stuff (namely private npm packages), (relatively) modern versions of Docker support build-time-only secr

For Go, I also take the vendor approach. But for other stuff (namely private npm packages), (relatively) modern versions of Docker support build-time-only secrets: https://docs.docker.com/develop/develop-images/build_enhancements/#new-docker-build-secret-information https://docs.docker.com/develop/develop-images/build_enhance.... Pass the secret as part of the docker build command and then access it inside RUN --mount=... stages.