runtimequestion 490 Application Delivery · hard
Find secrets baked into a Dockerfile
Every instruction's text is stored in the image's layers, so a secret written into a Dockerfile (see Secure Python) can be read by anyone who pulls the image. Write a check that finds them, reporting each by the line number where its instruction starts. (This reads Dockerfile text; Docker itself doesn't run here.)
Read and diagnose: this can't run in the browser, so you'll read real code and output and answer questions about it.
Function
baked_secrets(text)Instructionsskip blank and
# lines; a line ending in \ continues on the next line; report the first line number (from 1) of each instructionSecret setting
ENV or ARG with a NAME=value pair (several pairs allowed in one ENV) whose name contains SECRET, TOKEN, PASSWORD or KEY (any case) and whose value is not empty → "line <n>: <NAME> set in the image"Copied file
COPY or ADD whose sources include .env or a file ending in .pem → "line <n>: copies <file>"Returnsthe findings in instruction order (pairs and files in the order written)
Examples
callbaked_secrets('FROM python:3.12.7-slim\nWORKDIR /app\nARG PIP_INDEX_TOKEN=ghp_5x8Kd9f2aQ\nENV APP_ENV=prod \\\n STRIPE_SECRET_KEY=sk_live_51HxQe2Kd9f2a\nCOPY .env requirements.lock ./\nUSER market\n')returns['line 3: PIP_INDEX_TOKEN set in the image', 'line 4: STRIPE_SECRET_KEY set in the image', 'line 6: copies .env']
callbaked_secrets('FROM python:3.12.7-slim\nENV APP_ENV=prod PORT=8000\nCOPY requirements.lock .\n')returns[]
callbaked_secrets('# build\n\nFROM python:3.12.7-slim\nENV DB_PASSWORD=hunter2\n')returns['line 4: DB_PASSWORD set in the image']