DockerBattleOpsPhonePeRazorpayAsked in DevOps engineer and Platform engineer rounds
Someone put an API key in a Dockerfile ENV and later removed it. Is it safe now?
The scenario
A security scan flags an old image tag. The current Dockerfile no longer has the key.
Model answer
No. Every layer is kept in the image and its history, so anyone who can pull an old tag can read the key (docker history, or by extracting the layer).
- Rotate the key first. Assume it's leaked.
- Delete or overwrite the affected tags in the registry, and check whether they were ever public.
- Going forward: pass secrets at runtime (env from a secret manager, mounted files), and use BuildKit --secret for build-time secrets, which never lands in a layer.
- Add secret scanning (gitleaks, trufflehog) to CI and image scanning in the registry.
Common mistakes
- Thinking a later layer removes the secret
- Fixing the Dockerfile but not rotating the key
Practise it in War Zone · 1 free tryChallenge: harden this containerCoreOps · 60 min
Break it and fix it →