Security / Public reference

Secret file copied into an image

A Dockerfile COPY or ADD whose source is .env, id_rsa, id_ed25519, a .pem file, or a path ending in credentials.

What you need to supply

The Dockerfile text. The check does not read the copied file.

If it reports a finding

High severity. The suggested next step is to keep the secret file out of the image and mount it at runtime.

What this does not prove

COPY package.json is not this finding. A copy instruction that appears only in a comment is not a finding.

Instruction that this check is written to notice

COPY .env /app/.env

All review checks. Reading this page does not submit your infrastructure.