Run the example build. The Dockerfile first installed the OnVault client, and then by prefixing the instructions it has the ability to access the files from the server started in the previous step.

cat Dockerfile-onvault

During the build output you should see it using OnVault and getting access to the required secrets.

docker build -f Dockerfile-onvault -t onvault-test .

The secret is not stored in the image and has automatically been removed by OnVault.

docker run -it onvault-test ls /root/.ssh

This allows us to use secrets as part of our build, but never expose them within the image.