How should secrets be supplied to a container image build that needs a private package feed token?
- A Copy the token into a layer with COPY
- B Use a build-time secret mount so the value never persists in an image layer (correct answer)
- C Set it as an ENV instruction
- D Commit it to the repository
Shortcut: Anything written into a layer, including ENV and COPY, is recoverable from the image. Secret mounts expose the value only during that build step.