# syntax = docker/dockerfile:1.2
```

Then, add `--mount=type=secret,id=FILENAME,dst=/etc/secrets/FILENAME` to your run `RUN` instructions, replacing `FILENAME` with the name of your secret file.
If your filename contains non-alphanumeric characters, replace them with `_` for the `id=` part.
For example, if you have a secret file named `.env`, then using

```dockerfile
RUN --mount=type=secret,id=_env,dst=/etc/secrets/.env cat /etc/secrets/.env
```

will print the content of `.env` in your build.
You can make use of **multiple secret files** by adding more `--mount=type=secret,...`.

> The <code>--mount=type=secret,...</code> needs to be included for every instruction that requires the secret file.

Read more about Docker secrets and secret mounts in the [Docker Docs](https://docs.docker.com/develop/develop-images/build_enhancements/#new-docker-build-secret-information).

### Building Images with Secrets Locally

To build images locally with Dockerfiles that make use of secrets, you need to have a recent version of Docker installed.
When you run `docker build`, ensure that BuildKit is enabled with the `DOCKER_BUILDKIT=1` and pass in secrets using the `--secret` argument like so:

```bash
DOCKER_BUILDKIT=1 docker build --secret id=FILENAME,src=LOCAL_FILENAME ...
```

`FILENAME` is the same as the ID from `--mount=type=secret,id=FILENAME,...` in your Dockerfile and `LOCAL_FILENAME` is an appropriate secret file located on your build host.

Read more about Docker secrets and secret mounts in the [Docker Docs](https://docs.docker.com/develop/develop-images/build_enhancements/#new-docker-build-secret-information).

## Accessing Secret Files at Runtime

If you add [secret files](configure-environment-variables#secret-files) to a Docker-based service, those services are available at runtime at `/etc/secrets/<filename>`.

When accessing secret files in Docker services, you might encounter permission errors like the following:

```
cp: cannot open '/etc/secrets/myfile' for reading: Permission denied
```

To resolve this, make sure your application user is in group `1000`. You can set this in your Dockerfile:

```dockerfile