Docker Image Secrets

Definition

Docker image secrets leakage occurs when credentials embedded in Dockerfile RUN commands, ENV variables, or build arguments persist in image layer history — recoverable via docker history even after credential rotation.

Key Points

• Baseten case: GITHUB_TOKEN ARG expanded in RUN → visible in history[].created_by (2026-09-15-baseten-github-pat-security-breach)
• Old images in registries, CI caches, and developer laptops retain secrets indefinitely
• Mitigation: BuildKit --secret mounts, runtime credential injection, scoped short-TTL tokens
• TruffleHog and similar scanners detect secrets in pulled image layers

Related

• secrets-management
• supply-chain-security
• ci-cd
• baseten

Sources

• 2026-09-15-baseten-github-pat-security-breach