# Using Secrets with Docker

Docker services can access environment variables and secret files like other kinds of services at run time.
However, because of the way that Docker builds work, you won't have access to environment variables and secret files as usual at build time.

## Security

Before going into how to use your environment variables and secret files for Docker builds, you should know that using secrets with Docker can result in your image containing sensitive information.
Although we store your images securely, Docker registries should be treated like code repositories: it's best practice to not store secrets in them.
You should avoid using secrets in your Docker builds to eliminate the chance of accidentally storing sensitive material.

That being said, some build processes _require_ credentials to access private resources, for example.
For these, it's best to use [secret files](#secret-files-in-docker-builds).

## Secret Files in Docker Builds

The best way to use secrets in your Docker build is with secret files.
Unlike build args, secret mounts aren't persisted in your built image.

Secret files in Docker builds make use of secret mounts which are available with Dockerfile syntax v1.2.
At the top of your Dockerfile, add

```dockerfile