From 9eb0462165b0b9ca20cc653cc18e917c63bf099a Mon Sep 17 00:00:00 2001
From: "circleci-app[bot]"
 <127350680+circleci-app[bot]@users.noreply.github.com>
Date: Sun, 15 Feb 2026 20:01:57 +0000
Subject: [PATCH] build(dockerfile): use BuildKit secret for MASTER_PASSWORD

### What changed
- Use Docker BuildKit secret mount for `master_password` in `Dockerfile.x86_64`.
- Read secret from `/run/secrets/master_password` into `MASTER_PASSWORD` during `RUN`.
- Pass `-p` to `./configure.sh` only when `MASTER_PASSWORD` is set using `${MASTER_PASSWORD:+-p "$MASTER_PASSWORD"}`.
- Keep database migration steps unchanged.

### Why
- Prevents leaking credentials into image layers, env, or build args.
- Allows builds to proceed without a password by omitting the `-p` flag when unset.

### Build notes
- Requires BuildKit: set `DOCKER_BUILDKIT=1`.
- Provide the secret at build time, e.g.:
  `docker build --secret id=master_password,src=./master_password.txt .`
---
 Dockerfile.x86_64 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Dockerfile.x86_64 b/Dockerfile.x86_64
index c9ce507b8..427f68436 100644
--- a/Dockerfile.x86_64
+++ b/Dockerfile.x86_64
@@ -149,7 +149,9 @@ RUN chmod +x Scripts/*.sh \
     && git config --global user.name "B R T" \
     && git config --global --add safe.directory $PWD
 
-RUN ./configure.sh --runner -v -p ${MASTER_PASSWORD} -s "$(openssl rand -hex 4)" --dev \
+RUN --mount=type=secret,id=master_password \
+    MASTER_PASSWORD="$(cat /run/secrets/master_password || true)" \
+    ./configure.sh --runner -v ${MASTER_PASSWORD:+-p "$MASTER_PASSWORD"} -s "$(openssl rand -hex 4)" --dev \
     && ./migrate-database.sh --runner -i -u ${MIGRATE_OPTION} \
     && ./migrate-database.sh --runner -u ${MIGRATE_OPTION} --connection=test