Container images

npm or pip inside a docker build

Give the build your token without saving it in the image.

Dockerfile

# syntax=docker/dockerfile:1
FROM packages.example.com/node:22-alpine
WORKDIR /app
COPY package.json package-lock.json .npmrc ./
RUN --mount=type=secret,id=npm_token,env=NPM_TOKEN npm ci
COPY . .

docker build --secret id=npm_token,env=NPM_TOKEN -t storefront .

The .npmrc from Set up npm reads ${NPM_TOKEN}, and the secret mount sets it only while that one RUN step runs. For pip, mount the secret the same way and set PIP_INDEX_URL in the RUN line.