# Secrets in Dockerfile

> Detects credentials and secrets hardcoded in Dockerfile ENV instructions or ARG values that end up in image layers.

- Skill: `zakirkun/secrets-in-dockerfile` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/secrets-in-dockerfile`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/secrets-in-dockerfile/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/secrets-in-dockerfile

---


# Secrets in Dockerfile

## Overview
Secrets placed in Dockerfile `ENV` or `ARG` instructions are baked into image layers and visible via `docker inspect` or `docker history`, even if removed in a later layer. Anyone with pull access to the image can read these secrets.

## Remediation
- Use Docker secrets (`--secret`) for sensitive values during build
- Use multi-stage builds to exclude build-time secrets from final image
- Use `.env` files with `--env-file` at runtime instead of baking into image
- Use HashiCorp Vault, AWS Secrets Manager, or Kubernetes Secrets for runtime injection