Security / Public reference

Secret assigned in an image variable

A Dockerfile ENV or ARG whose name is password, passwd, secret, api_key, apikey, auth_token, access_key, private_key, or token, with a non-empty literal value.

What you need to supply

The Dockerfile text. The check does not build the image.

If it reports a finding

High severity. The suggested next step is to pass the value at runtime or from a secret mount.

What this does not prove

ENV NODE_ENV=production, ENV PATH=/usr/bin, ARG VERSION=1, ENV TOKEN=$TOKEN, and ENV TOKEN=${TOKEN} are not this finding. A commented assignment is not a finding.

Instruction that this check is written to notice

ENV API_KEY=abcd

All review checks. Reading this page does not submit your infrastructure.