# Mount secrets during build step

**URL:** <https://community.okteto.com/t/mount-secrets-during-build-step/845>\
**Category:** How Do I?\
**Created:** [June 1, 2023, 2:11pm UTC](https://community.okteto.com/t/mount-secrets-during-build-step/845 "2023-06-01T14:11:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![boedy](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/boedy/32/388_2.png) [@boedy](https://community.okteto.com/u/boedy)\
**Post date:** [June 1, 2023, 2:11pm UTC](https://community.okteto.com/t/mount-secrets-during-build-step/845/1 "2023-06-01T14:11:56Z")

</div>

Our Docker images are usually built in Github actions. They sometimes need to mount secrets during build time. I’ve included an example below:

```bash
RUN --mount=type=secret,id=github_token \
    composer config --global github-oauth.github.com $(cat /run/secrets/github_token) && \
    composer install \
      --ignore-platform-reqs \
      --no-interaction \
      --no-plugins \
      --no-scripts \
      --prefer-dist

```

I’m trying to figure out how I can get this work with the oktetoy.yaml file. Is this possible?

---

<div class="post-metadata">

**Author:** ![maroshii](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/maroshii/32/12_2.png) [@maroshii](https://community.okteto.com/u/maroshii)\
**Post date:** [June 1, 2023, 2:32pm UTC](https://community.okteto.com/t/mount-secrets-during-build-step/845/2 "2023-06-01T14:32:46Z")

</div>

Hi @boedy,

You can pass build arguments to the okteto cli as you would to a docker build:

```auto
okteto build --secret id=github_token,src=qwerty -t my-image .

```

You can also define you secrets in the okteto.yml file:

```yaml
build:
  api:
    ...
    secrets:
      github_token: qwerty

```

More info in the docs: [Okteto Manifest | Okteto Documentation](https://www.okteto.com/docs/reference/manifest/#build-object-optional)

Hope it helps!  
Francisco

---

<div class="post-metadata">

**Author:** ![boedy](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/boedy/32/388_2.png) [@boedy](https://community.okteto.com/u/boedy)\
**Post date:** [June 1, 2023, 2:48pm UTC](https://community.okteto.com/t/mount-secrets-during-build-step/845/3 "2023-06-01T14:48:07Z")

</div>

Thanks for the prompt reply @maroshii . It seems it needs to be a file? Can a secret stored in Okteto be used? Something in in the lines of:

```yaml
build:
  api:
    ...
    secrets:
      github_token: $GITHUB_TOKEN

```

---

<div class="post-metadata">

**Author:** ![maroshii](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/maroshii/32/12_2.png) [@maroshii](https://community.okteto.com/u/maroshii)\
**Post date:** [June 1, 2023, 2:56pm UTC](https://community.okteto.com/t/mount-secrets-during-build-step/845/4 "2023-06-01T14:56:57Z")

</div>

According to the docs `$GITHUB_TOKEN` should be defined in the environment so you should be able to `export GITHUB_TOKEN=asdfg` before running the build:

- `secrets`: list of secrets exposed to the build. The value of each secret refers to a file. Okteto will resolve references containing a `$` sign in this file to the environment variable value on the machine okteto is running on.

Okteto secrets are runtime secrets so they are not available at build time