Docker "secret target path not mounted (--mount=type=secret)" in CI

By Daniel Zoghalchali·Latchkey

A RUN --mount=type=secret only exposes the secret if the build was invoked with a matching --secret. When the id is missing, the env source is unset, or the target path differs from where the command reads, the secret file is simply absent at build time.

What this error means

A build step that reads a secret file fails because the file is empty or missing under /run/secrets/, even though the mount line is present in the Dockerfile.

ERROR: failed to solve: failed to compute cache key: /run/secrets/npm_token: no such file or directory
# the --mount=type=secret target was not provided at build time

Common causes

The build was not invoked with --secret

A RUN --mount=type=secret,id=npm_token needs --secret id=npm_token,... on the build command; without it the mount is empty.

A mismatched id or target path

The mount id must match the --secret id=, and the file appears at /run/secrets/<id> unless an explicit target= is set and read at the same path.

How to fix it

Pass the secret on the build command

1. Declare the mount in the Dockerfile and pass a matching --secret.
2. Read the secret at /run/secrets/<id> inside the RUN.

# Dockerfile
RUN --mount=type=secret,id=npm_token \
    NPM_TOKEN=$(cat /run/secrets/npm_token) npm ci

Wire the secret in build-push-action

1. Use the secrets input so the id matches the Dockerfile mount.

- uses: docker/build-push-action@v6
  with:
    context: .
    secrets: |
      npm_token=${{ secrets.NPM_TOKEN }}

How to prevent it

• Keep the mount id and the --secret id identical.
• Read secrets from /run/secrets/<id> unless you set target= explicitly.
• Never bake secrets into ARG/ENV - use secret mounts.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation