Don't leak your Docker image's build secrets