dockerleaks

Accidentally Making the Docker Image Public
Common Mistake:
A developer might accidentally push a private image to a public Docker Hub repo (e.g., by forgetting to use --private when pushing).
docker tag my-private-image mydockerhubuser/myrepo:latest
docker push mydockerhubuser/myrepo:latest  # If repo is public, it's exposed!
Risk: If the image contains hardcoded API keys, credentials, or secrets, they become public immediately.
  Extracting Layers from a Private Image
Even if an image is private, if an attacker gains access to it, they can extract sensitive information by inspecting the Docker image layers.
  If secrets were added in an early layer (RUN echo "SECRET_KEY=xyz123"), it remains in the image even if it's later removed.
🛑 How to Avoid This?
Use .dockerignore to exclude sensitive files from being copied into the image.
Avoid ADD or COPY secrets into the image.
Use build-time secrets instead of hardcoding them.
Docker Hub Credentials Leaked → Private Images Can Be Pulled
Attackers can steal credentials from misconfigured CI/CD pipelines or leaked .docker/config.json files.
If an attacker gets read access to a private Docker registry, they can:
Pull the private image (docker pull mycompany/private-app).
Inspect layers for secrets (docker history or docker run --rm -it mycompany/private-app /bin/sh).
🔎 Example: Leaked Docker Login File
If the ~/.docker/config.json file is publicly readable, an attacker can extract:
 How to Avoid This?
Never store credentials in plain text.
Use environment variables (DOCKER_PASSWORD, DOCKER_CONFIG) in CI/CD.
Enable 2FA (Two-Factor Authentication) for Docker Hub accounts.
 Conclusion
Even if an image is private, hardcoded secrets can still leak due to: 1️⃣ Accidental public uploads.
2️⃣ Extracting secrets from Docker image layers.
3️⃣ Leaked credentials to pull private images.
4️⃣ Secrets in ENV variables inside the Dockerfile.
5️⃣ Including .env files in the image.

✅ Best Practices to Prevent Leaks
✔ Use .dockerignore to exclude secret files.
✔ Pass secrets at runtime instead of hardcoding them.
✔ Use Docker secrets or a vault like AWS Secrets Manager.
✔ Check for secrets before pushing an image:

 How to Prevent This? ✔ Use a .dockerignore file to prevent secret files from being copied:
.env
config/secrets.yml
private_key.pem
 Summary: Complete List of Docker Secret Leaks
#	Leak Source	How It Happens?	Fix
1️⃣	Public Docker Image Upload	Pushing an image to a public registry accidentally.	Use private repos and enable 2FA on Docker Hub.
2️⃣	Extracting Layers (docker history)	Old secrets remain in cached layers even if removed.	Use --no-cache when building images.
3️⃣	Leaked Docker Hub Credentials	.docker/config.json can expose login tokens.	Store credentials securely and enable 2FA.
4️⃣	Hardcoded ENV Variables	ENV SECRET=xyz stores secrets inside image history.	Use Docker Secrets instead of ENV.
5️⃣	Copying Secrets into Image (COPY . /)	.env files get baked into image layers.	Add .env to .dockerignore.
6️⃣	Build Context Leaks	Local files copied into image unintentionally.	Always check docker build --progress=plain.
7️⃣	Secrets in Base Images	Using a compromised public image.	Use trusted base images and scan with trivy.
8️⃣	Attacker Runs docker exec	Extracts secrets from env variables in running containers.	Avoid ENV secrets, use Vault instead.
9️⃣	Exposing Docker Daemon (/var/run/docker.sock)	Allows full access to the host system.	Never mount docker.sock in untrusted containers.
🔟	Secrets in Logs (docker logs)	Logs expose database passwords.	Use secure logging tools, never log secrets.
 Always use .dockerignore to exclude sensitive files.

API Keys: Unique identifiers used to authenticate requests associated with your project or application.
Tokens: Security tokens (like OAuth tokens) that grant access to protected resources.