Keep Build-Time Proxy Credentials Out of Docker Images

For package downloads during a build, use Docker's predefined proxy build inputs rather than save a temporary route in Dockerfile ENV. A POSIX invocation can supply:

HTTP_PROXY=http://203.0.113.10:8080 \
HTTPS_PROXY=http://203.0.113.10:8080 \
docker build --build-arg HTTP_PROXY --build-arg HTTPS_PROXY .

Replace the documentation endpoint. Omitting values after the --build-arg names takes them from this invocation's environment. Matching ARG declarations are not required for these predefined inputs.

Docker excludes those proxy arguments from build-cache handling and docker history by default. Explicitly referencing them in the Dockerfile changes that behavior, so do not add declarations merely because another build-argument example does.

The process still receives the values. An authenticated URL can escape through printed environment, logs, copied config or later image operations even if one history view omits it. Dockerfile ENV makes a route part of the final image environment and can turn a build-only proxy into every container's dependency.

When a command needs sensitive material, BuildKit secret mounts provide a build-time secret interface. Limit the credential to that operation; do not print the mount or copy its contents into an image layer.

These build inputs configure neither the daemon's earlier registry pull nor an unreachable remote builder's host route. Afterward, inspect the intended final image and application configuration for persistent proxy values instead of assuming temporary input handling removed every copy.