This approach has sparked my interest, could you post an example of any open source docker-compose file and/or associated scripts that would do this?
As long as you add the file and remove it in the same command it doesn't get committed as an extra layer, so the container won't have any history of the secrets. You'll run into problems if you do multiple RUN's or an ADD and then RUN.
