Secrets baked into an image
An image deleted its .npmrc after install, so the team thought the token was gone. Read the Dockerfile, image history, and config to find every secret that shipped anyway.
Briefing
shop-api:1.8 is about to be published to a partner registry. Security asked you to confirm it carries no credentials.
Each Dockerfile instruction becomes a layer. Build arguments used in RUN show up in docker history, and ENV values sit in the image config for anyone who pulls it. Deleting a file in a later layer does not remove it from earlier ones.
build-02 · Container audit
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.