Class: Dash::Dockerfile::Rules::SecretInBuildArg

Inherits:
Base
  • Object
show all
Defined in:
lib/dash/dockerfile/rules/secret_in_build_arg.rb

Overview

Build args and ENV values are readable in the image history forever. A secret that has to be present at build time belongs in a mount that leaves no layer behind.

Constant Summary collapse

SECRETISH = 
/(PASSWORD|SECRET|TOKEN|_KEY)\b/i
ALLOWED =

Rails' own placeholder: it exists precisely so no real key is needed at build time.

%w[ SECRET_KEY_BASE_DUMMY ].freeze
SUGGESTION = 
"pass it with --mount=type=secret and list it under builder: secrets: in deploy.yml"

Instance Method Summary collapse

Instance Method Details

#findings ⇒ Object 



9
10
11
12
13
14
15
16
17
18
19
 
# File 'lib/dash/dockerfile/rules/secret_in_build_arg.rb', line 9

def findings
  document.instructions.flat_map do |instruction|
    next [] unless %w[ ARG ENV ].include?(instruction.name)

    names(instruction).filter_map do |name|
      next if ALLOWED.include?(name) || !name.match?(SECRETISH)

      warning at(instruction), "#{instruction.name} #{name} bakes a secret into the image history", SUGGESTION
    end
  end
end