A pipeline builds and pushes an image that deploys a Meraki reporter. Where should the registry password and deploy token live?
Select an answer to reveal the explanation.
Short Explanation
Pipeline secrets are day passes handed to that job only—not printed on every jersey leaving the factory. Inject from the CI store; never COPY secrets.json into layers every puller receives.
Full Explanation
CI credentials belong in the CI secret store and should be injected into the job that needs them—never baked into image layers. Every puller of the image would otherwise receive deploy tokens meant only for the pipeline that built the civic artifact, including developers who only needed a runtime image. Using COPY secrets.json during docker build permanently embeds secrets in layers even if a later layer deletes the file from the visible filesystem; layer history still holds the bytes. Committing CI credentials into the Dockerfile as ENV defaults likewise writes them into image history and local build caches that outlive the job. Printing the deploy token into build logs so operators can reuse it on laptops spreads the secret into log backends and chat pastes far outside the pipeline boundary. Exam caveat: multi-stage builds do not erase secrets from earlier layers that remain in the builder cache or intermediate images unless those layers are truly discarded and the builder is scrubbed. Operational check: inspect the final image history and run a registry or local scan for secret filenames or ENV defaults, and confirm the pipeline job receives credentials only from the CI secret mapping at job runtime.