Comment 5 for bug 1960858

(Though possibly we could do `docker login` and ensure that `docker build` doesn't see the raw credentials. I don't know how `docker login` stores credentials.)