The Secret in the Image

The situation

A routine security review of Code Nexus's registry pulled the layers of the published Code Nexus Assist image and found an API key in them: a synthetic training credential, but a credential all the same. Someone had been careful. There is even a line in the Dockerfile that deletes the file after copying it in. The review's question is not whether the key is real but who can pull the image, and how the team would know if someone already had.

What you'll learn

• Docker security and supply chain: what image layers and history retain, secrets in files, ENV and ARG, non-root execution, scanning for vulnerabilities and secrets, tags versus digests, pinning a deployment to a digest, rotating a leaked credential, unpublishing an image, and verifying both the remediation and the service.

Who you work with

• 

  Lydia Roe

  Security Engineer

• 

  Kabelo Mokoena

  Platform and DevOps Engineer

• 8-BIT

  Code Nexus Internal AI Assistant

Scenes

1. 1.A key in layer two
2. 2.What an image remembers
3. 3.Rebuild it clean
4. 4.Contain it
5. 5.Image security check

What you leave with

The `rm` in the Dockerfile hid the key from the running container and left it in the layer, and the ENV line put it in the image configuration in plain text, so anyone who could pull the image could read it. The clean rebuild keeps the key out of the build context and supplies it at run time, bumps the vulnerable dependency, runs as a non-root user, and is pinned by digest, so the deployment runs exactly the image that was scanned. Containing the leak meant revoking the credential after the replacement was live, stopping and unpublishing the leaky image, and then proving both halves: the old key fails with a revoked-credential error, and the new image authenticates and runs.