if you pass secrets in as builder args they get embedded into the container image, which means that your container images now contain secrets too and must be managed as secrets