Skip to content

docs(security): warn against secrets in run[]/setup steps #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
enixCode merged 1 commit into from
Jun 4, 2026
Merged

docs(security): warn against secrets in run[]/setup steps #24

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions website/content/docs/security.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,8 @@ For genuinely hostile code (anonymous user-submitted source, AI-agent-generated

Avoid putting API keys in `env`. Avoid putting them in `entrypoint`. Avoid putting them in `dir` (they would be tarred into the seed archive and visible to anyone with access to the volume).

**Never put a secret in a `run[]`/`setup` build step.** Those compile into `RUN` instructions and are baked permanently into the cached image layer (`light-runner-cache:<sha>`); cache TTL eviction removes the image on a schedule but never scrubs the secret from a layer that already exists or that was pushed elsewhere. If a build step needs a credential (a private registry, an authenticated download), pass it at run time via `input` or a mounted file instead.

## Hardening recipes

### Air-gapped run (no network, untrusted source code)
Expand Down