クレデンシャルをビルド中に削除しても、レイヤに残ってしまう件について実際に手を動かして確認してみます。
ubuntu@test-vm-01:~/test$ cat Dockerfile
FROM public.ecr.aws/nginx/nginx:1.25-alpine-slim
RUN echo "this is secret" > /secret.txt
RUN rm /secret.txt
ubuntu@test-vm-01:~/test$ docker build -f Dockerfile -t test:latast .
ubuntu@test-vm-01:~/test$ docker save test:latast | tar -xC dump/
ubuntu@test-vm-01:~/test$ grep "this is secret" dump/blobs/sha256/26e6cd8b82ed33846375b5484f907ec7547b1b58919e607d7954f6ed9f36f5ab
...
{"created":"2024-03-21T16:21:04.288826451+09:00","created_by":"RUN /bin/sh -c echo \"this is secret\" \u003e /secret.txt # buildkit","comment":"buildkit.dockerfile.v0"},{"created":"2024-03-21T16:21:04.637976236+09:00","created_by":"RUN /bin/sh -c rm /secret.txt # buildkit","comment":"buildkit.dockerfile.v0"}],"os":"linux","rootfs":{"type":"layers","diff_ids":
...