Docker secrets, and why most teams ship them anyway

Thu, 12 Sep 2024 00:00:00 +0000

I’ve seen this happen more times than I’d like to admit: someone commits a .env file, or bakes an API key directly into a Dockerfile, and it ends up in the final image. Sometimes it’s in git history. Sometimes it’s in the layer cache. Often both.

Why it keeps happening

The problem isn’t that developers are careless. The problem is that the path of least resistance is almost always the insecure one.

Devops on void.log

Docker secrets, and why most teams ship them anyway

Why it keeps happening