diff --git a/sections/docker/avoid-build-time-secrets.md b/sections/docker/avoid-build-time-secrets.md
index 2d33ee08..2b3b899a 100644
--- a/sections/docker/avoid-build-time-secrets.md
+++ b/sections/docker/avoid-build-time-secrets.md
@@ -15,7 +15,7 @@ A Docker image isn't just a bunch of files but rather multiple layers revealing
Dockerfile
-```
+```dockerfile
# syntax = docker/dockerfile:1.0-experimental
FROM node:12-slim
@@ -36,19 +36,23 @@ RUN --mount=type=secret,id=npm,target=/root/.npmrc npm ci
Dockerfile
-```
-
+```dockerfile
FROM node:12-slim AS build
+
ARG NPM_TOKEN
+
WORKDIR /usr/src/app
COPY . /dist
+
RUN echo "//registry.npmjs.org/:\_authToken=\$NPM_TOKEN" > .npmrc && \
npm ci --production && \
rm -f .npmrc
+
FROM build as prod
+
COPY --from=build /dist /dist
-CMD ["node","index.js"]
+CMD ["node", "index.js"]
# The ARG and .npmrc won't appear in the final image but can be found in the Docker daemon un-tagged images list - make sure to delete those
```
@@ -63,19 +67,21 @@ CMD ["node","index.js"]
Dockerfile
-```
-
+```dockerfile
FROM node:12-slim
+
ARG NPM_TOKEN
+
WORKDIR /usr/src/app
COPY . /dist
+
RUN echo "//registry.npmjs.org/:\_authToken=\$NPM_TOKEN" > .npmrc && \
npm ci --production && \
rm -f .npmrc
# Deleting the .npmrc within the same copy command will not save it inside the layer, however it can be found in image history
-CMD ["node","index.js"]
+CMD ["node", "index.js"]
```