Dockerfile: assuming we are mounting /srv/secret