The Leaky Docker Secret

CRITICAL — credentials exposed in public image

Security Team: A researcher ran docker history on my-app:latest and found `BUILD_API_KEY` in plaintext. Key rotated — fix CI before the next push.

The trap: ENV BUILD_API_KEY=$BUILD_API_KEY during build bakes the secret into layer history. Setting ENV BUILD_API_KEY="" later is a fake fix — layer 3 still leaks.

Your task

Secure `Dockerfile`: remove ENV/ARG secret pattern; use BuildKit --mount=type=secret,id=api_key and read from /run/secrets/api_key for the download_data.py step only.

Book: build args / ENV for secrets · Prod: image layers are immutable — use BuildKit secret mounts.