From 070d4d6d69d40ad0e19b4765ee1f9e0b87946dd8 Mon Sep 17 00:00:00 2001
From: yeasy <yangbaohua@gmail.com>
Date: Sat, 6 Jun 2026 00:43:52 -0700
Subject: [PATCH] fix(content): harden secret handling examples

---
 07_dockerfile/7.7_arg.md  | 10 ++++++----
 16_cloud/16.3_alicloud.md | 19 +++++++++++++------
 2 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/07_dockerfile/7.7_arg.md b/07_dockerfile/7.7_arg.md
index 6bd4b26..498fd4c 100644
--- a/07_dockerfile/7.7_arg.md
+++ b/07_dockerfile/7.7_arg.md
@@ -146,17 +146,19 @@ RUN if [ "$ENABLE_DEBUG" = "true" ]; then \
 
 #### 4. 配置私有仓库
 
-```docker
-ARG NPM_TOKEN
+不要用 `ARG` 或 `ENV` 传递仓库 token。Docker 官方构建检查会把这类写法视为不安全，因为构建参数和环境变量可能进入镜像元数据或历史记录。使用 BuildKit secret mount 只在单条 `RUN` 指令期间暴露凭据：
 
-RUN echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc && \
+```docker
+RUN --mount=type=secret,id=npm_token \
+    NPM_TOKEN="$(cat /run/secrets/npm_token)" && \
+    printf "//registry.npmjs.org/:_authToken=%s\n" "$NPM_TOKEN" > ~/.npmrc && \
     npm install && \
     rm ~/.npmrc
 ```
 ```bash
 ## 构建时传入 token
 
-$ docker build --build-arg NPM_TOKEN=xxx .
+$ docker build --secret id=npm_token,env=NPM_TOKEN .
 ```
 ---
 
diff --git a/16_cloud/16.3_alicloud.md b/16_cloud/16.3_alicloud.md
index 330a280..43f1714 100644
--- a/16_cloud/16.3_alicloud.md
+++ b/16_cloud/16.3_alicloud.md
@@ -247,12 +247,19 @@ spec:
 在 ACK 集群中创建 Secret，用于拉取私有镜像：
 
 ```bash
-# 创建镜像拉取 Secret
-kubectl create secret docker-registry acr-secret \
-  --docker-server=registry.cn-hangzhou.aliyuncs.com \
-  --docker-username=<阿里云账户ID> \
-  --docker-password=<RAM访问密钥或密码> \
-  --docker-email=<邮箱地址>
+# 避免把真实口令写入命令历史。使用临时 Docker config 并通过标准输入登录。
+export DOCKER_CONFIG="$(mktemp -d)"
+read -rsp "ACR token: " ACR_TOKEN; echo
+printf "%s" "$ACR_TOKEN" | docker login registry.cn-hangzhou.aliyuncs.com \
+  --username "<阿里云账户ID>" \
+  --password-stdin
+
+kubectl create secret generic acr-secret \
+  --from-file=.dockerconfigjson="$DOCKER_CONFIG/config.json" \
+  --type=kubernetes.io/dockerconfigjson
+
+rm -rf "$DOCKER_CONFIG"
+unset ACR_TOKEN DOCKER_CONFIG
 
 # 查看创建的 Secret
 kubectl get secret acr-secret