Use a Build Secret Instead of ARG

Labs have no container engine, so nothing is built or started: your files are checked by reading them, the way a reviewer or a CI linter would. docker-compose config (to validate Compose files) and hadolint (a Dockerfile linter) are installed.

The Dockerfile in /home/student/projects/search-api installs packages from a private npm registry. It receives the token with --build-arg NPM_TOKEN=…, which stores the token in the image metadata (docker history shows it) and in an .npmrc layer.

Task

Rewrite the Dockerfile so that:

• the token is not passed as an ARG or ENV, and is never written into a file that stays in the image
• npm ci gets the token from a BuildKit secret with id npm_token, mounted only for that RUN
• the build is still invoked as docker build --secret id=npm_token,env=NPM_TOKEN .
• the rest of the build stays the same (base image, install, copy, start command)