Profile My skills Saved Collections Edit profile Submit a skill

Secrets in Dockerfile

Detects credentials and secrets hardcoded in Dockerfile ENV instructions or ARG values that end up in image layers.

zakirkun 929b3e1 2 files · 2.8 KB Updated
Coding & Dev Tools

File contents

Secrets in Dockerfile

Overview

Secrets placed in Dockerfile ENV or ARG instructions are baked into image layers and visible via docker inspect or docker history, even if removed in a later layer. Anyone with pull access to the image can read these secrets.

Remediation

  • Use Docker secrets (--secret) for sensitive values during build
  • Use multi-stage builds to exclude build-time secrets from final image
  • Use .env files with --env-file at runtime instead of baking into image
  • Use HashiCorp Vault, AWS Secrets Manager, or Kubernetes Secrets for runtime injection

zakirkun/ice-tea/tree/main/skills/devops/secrets-in-dockerfile commit 929b3e1e00

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/secrets-in-dockerfile