Thanks — this is a great question, and you’re right to avoid putting long-lived build-time credentials into the LiveKit agent runtime. Below are concise best practices for using lk agent deploy with a pre-built image and keeping build-time secrets out of LiveKit. Deploy a pre-built image 1. Build and push the container from your CI/CD pipeline (GitHub Actions, GitLab CI, etc.). 2. Deploy that image directly with:

lk agent deploy --image your-registry/your-agent:tag

This bypasses LiveKit’s cloud build so build-time credentials never need to exist in the agent’s .env. Separate build-time vs runtime credentials • Build-time credentials: keep these strictly in your CI/CD environment (pipeline secrets, ephemeral tokens). Use them only during image build to fetch private packages or private repos. Do NOT copy these into the final image or provide them to LiveKit. • Runtime credentials: only include secrets needed at agent runtime (LLM keys, STT/TTS keys, runtime service credentials). Provide these via LiveKit’s secrets handling so they are injected at runtime and can be rotated without rebuilding the image. How to supply runtime secrets to LiveKit • Use the CLI secrets commands to provide runtime env vars to LiveKit (create/update secrets). Example patterns: ◦ Create with a secrets file:

lk agent create --secrets-file .env --region us-east

◦ Update secrets without redeploying:

lk agent update-secrets --secrets API_KEY=new-value --overwrite

Secrets provided this way are injected at runtime and can be updated independently of the container image. Container build best practices • Multi-stage builds: keep build-only tools and credentials in earlier stages so they aren’t present in the final image. • .dockerignore: exclude local creds, CI artifacts, and any files that aren’t needed at runtime. • Remove or avoid embedding credentials in images or source (use build args in CI only and never commit). • Run non-root where possible and follow general image-hardening steps. • Pre-download large models or heavy dependencies in the build stage so runtime startup is fast, but ensure those downloads don’t require long-lived secrets at runtime. CI/CD recommendations • Use short-lived tokens for any registry or repo access; scope them narrowly. • Store secrets in your CI secret store (GitHub/GitLab secrets, Vault, AWS Secrets Manager) and inject them into the build step only. • Scan images for accidentally included secrets before pushing (linting or secret-scanning tools). If you want, I can help with: • An example multi-stage Dockerfile that excludes build secrets. • A CI pipeline snippet (GitHub Actions or GitLab CI) that builds, scans, pushes, and then runs

lk agent deploy --image

. • Exact

lk

CLI command examples based on your agent name/region. Which of those would be most helpful next? Sources: Deployment reliability on LiveKit Cloud | LiveKit | Agents Framework | livekit/livekit_composite | DeepWiki | examples/drive-thru | livekit/livekit_composite | DeepWiki | Agents (Python) | livekit/livekit_composite | DeepWiki | Examples | livekit/livekit_composite | DeepWiki