@@ -1115,7 +1115,7 @@ examples: |-
11151115 ```dockerfile
11161116 # syntax=docker/dockerfile:1
11171117
1118- FROM oven/bun:1 as base
1118+ FROM oven/bun:1 AS base
11191119 WORKDIR /app
11201120
11211121 FROM base AS install
@@ -1401,17 +1401,39 @@ examples: |-
14011401
14021402 Supported types are:
14031403
1404- - [`file`](#file )
1405- - [`env`](#env )
1404+ - [`type= file`](#typefile )
1405+ - [`type= env`](#typeenv )
14061406
1407- Buildx attempts to detect the `type` automatically if unset.
1407+ Buildx attempts to detect the `type` automatically if unset. If an environment
1408+ variable with the same key as `id` is set, then Buildx uses `type=env` and the
1409+ variable value becomes the secret. If no such environment variable is set, and
1410+ `type` is not set, then Buildx falls back to `type=file`.
14081411
1409- #### `file`
1412+ #### `type= file`
14101413
1411- Attribute keys:
1414+ Source a build secret from a file.
1415+
1416+ ##### `type=file` synopsis
1417+
1418+ ```console
1419+ $ docker buildx build --secret [type=file,]id=<ID>[,src=<FILEPATH>] .
1420+ ```
1421+
1422+ ##### `type=file` attributes
1423+
1424+ | Key | Description | Default |
1425+ | --------------- | ----------------------------------------------------------------------------------------------------- | -------------------------- |
1426+ | `id` | ID of the secret. | N/A (this key is required) |
1427+ | `src`, `source` | Filepath of the file containing the secret value (absolute or relative to current working directory). | `id` if unset. |
1428+
1429+ ###### `type=file` usage
14121430
1413- - `id` - ID of the secret. Defaults to base name of the `src` path.
1414- - `src`, `source` - Secret filename. `id` used if unset.
1431+ In the following example, `type=file` is automatically detected because no
1432+ environment variable mathing `aws` (the ID) is set.
1433+
1434+ ```console
1435+ $ docker buildx build --secret id=aws,src=$HOME/.aws/credentials .
1436+ ```
14151437
14161438 ```dockerfile
14171439 # syntax=docker/dockerfile:1
@@ -1421,16 +1443,31 @@ examples: |-
14211443 aws s3 cp s3://... ...
14221444 ```
14231445
1446+ #### `type=env`
1447+
1448+ Source a build secret from an environment variable.
1449+
1450+ ##### `type=env` synopsis
1451+
14241452 ```console
1425- $ docker buildx build --secret id=aws,src=$HOME/.aws/credentials .
1453+ $ docker buildx build --secret [type=env,] id=<ID>[,env=<VARIABLE>] .
14261454 ```
14271455
1428- #### ` env`
1456+ ##### `type= env` attributes
14291457
1430- Attribute keys:
1458+ | Key | Description | Default |
1459+ | ---------------------- | ----------------------------------------------- | -------------------------- |
1460+ | `id` | ID of the secret. | N/A (this key is required) |
1461+ | `env`, `src`, `source` | Environment variable to source the secret from. | `id` if unset. |
1462+
1463+ ##### `type=env` usage
1464+
1465+ In the following example, `type=env` is automatically detected because an
1466+ environment variable matching `id` is set.
14311467
1432- - `id` - ID of the secret. Defaults to `env` name.
1433- - `env` - Secret environment variable. `id` used if unset, otherwise will look for `src`, `source` if `id` unset.
1468+ ```console
1469+ $ SECRET_TOKEN=token docker buildx build --secret id=SECRET_TOKEN .
1470+ ```
14341471
14351472 ```dockerfile
14361473 # syntax=docker/dockerfile:1
@@ -1440,10 +1477,26 @@ examples: |-
14401477 yarn run test
14411478 ```
14421479
1480+ In the following example, the build argument `SECRET_TOKEN` is set to contain
1481+ the value of the environment variable `API_KEY`.
1482+
14431483 ```console
1444- $ SECRET_TOKEN =token docker buildx build --secret id=SECRET_TOKEN .
1484+ $ API_KEY =token docker buildx build --secret id=SECRET_TOKEN,env=API_KEY .
14451485 ```
14461486
1487+ You can also specify the name of the environment variable with `src` or `source`:
1488+
1489+ ```console
1490+ $ API_KEY=token docker buildx build --secret type=env,id=SECRET_TOKEN,src=API_KEY .
1491+ ```
1492+
1493+ > [!NOTE]
1494+ > Specifying the environment variable name with `src` or `source`, you are
1495+ > required to set `type=env` explicitly, or else Buildx assumes that the secret
1496+ > is `type=file`, and looks for a file with the name of `src` or `source` (in
1497+ > this case, a file named `API_KEY` relative to the location where the `docker
1498+ > buildx build` command was executed.
1499+
14471500 ### Shared memory size for build containers (--shm-size) {#shm-size}
14481501
14491502 Sets the size of the shared memory allocated for build containers when using
0 commit comments