A pipeline builds and pushes an image that deploys a Meraki reporter. Where should the registry password and deploy token live?
Select an answer to reveal the explanation.
Short Explanation
Pipeline secrets are day passes handed to that job only—not printed on every jersey leaving the factory. Inject from the CI store; never COPY secrets.json into layers every puller receives.
Full Explanation
Registry passwords and deploy tokens belong in the CI system’s secret store and are injected into the specific job. Baking secrets with COPY or ENV during docker build publishes them to anyone who can pull the image. That distinction is about secret injection versus layer contamination, not general pipeline diagnosis.