Remove a build secret that was copied into a container layer.

Instruction: Identify the exposure and redesign the build without treating deletion as erasure.

Context:

A fictional Dockerfile copies .npmrc containing a registry token into a builder stage, installs dependencies, then deletes the file in a later instruction. The team exports build cache to a shared registry. The final runtime stage copies only compiled assets. A colleague claims the token cannot be exposed because it is absent from the final image.

Updated

Official answer available

Read the opening below, then unlock the full answer and practical guidance.

The final runtime stage may exclude the token, but the builder layers and exported cache can still contain it...

Upgrade to view official answer

Related Questions