Differences

This shows you the differences between two versions of the page.

--- docker:security:don_t_leak_sensitive_information_to_docker_images [2020/04/18 20:00] – peter
+++ docker:security:don_t_leak_sensitive_information_to_docker_images [2020/07/15 09:30] (current) – external edit 127.0.0.1
@@ Line 15: / Line 15: @@
 These tokens and keys must be kept outside of the **Dockerfile**.
+----
+===== Using Docker secret commands =====
+Use an alpha feature in Docker for managing secrets to mount sensitive files without caching them, similar to the following:
+<file bash Dockerfile>
+# syntax = docker/dockerfile:1.0-experimental
+FROM alpine
+# shows secret from default secret location
+RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecre
+# shows secret from custom secret location
+RUN --mount=type=secret,id=mysecret,dst=/foobar cat /foobar
+</file>
+Read more about Docker secrets on their site.
+----
+===== Beware of recursive copy =====
+You should also be mindful when copying files into the image that is being built.
+For example, the following command copies the entire build context folder, recursively, to the Docker image, which could end up copying sensitive files as well:
+<code>
+COPY . .
+</code>
+If you have sensitive files in your folder, either remove them or use **.dockerignore** to ignore them:
+<code>
+private.key
+appsettings.json
+</code>