Image layers are scanned for hardcoded credentials and secrets

Secrets baked into Docker image layers are permanently readable by anyone with registry pull access — including future employees, CI systems, and compromised tokens (OWASP A02, CWE-540). Docker layer history exposes every ARG, ENV, and RUN instruction even after a subsequent RUN unset — the value persists in the lower layer. NIST 800-53 SC-28 requires protection of information at rest; credentials in registry layers violate that control and are disclosed with every docker history command. This is one of the most common paths to credential exposure in containerized environments.

Use multi-stage builds to ensure secrets never land in the final image layer. In Dockerfile:

# Build stage — secret is accessible here
FROM node:20 AS builder
ARG PRIVATE_TOKEN
RUN git clone https://${PRIVATE_TOKEN}@github.com/org/private-repo.git /src
RUN cd /src && npm ci && npm run build

# Runtime stage — secret never copied
FROM node:20-alpine
COPY --from=builder /src/dist /app
CMD ["node", "/app/index.js"]

For runtime secrets, inject via Kubernetes Secrets (secretKeyRef) or a secrets manager (Vault, AWS Secrets Manager). Never use ENV SECRET=value in the final stage — use docker secret or runtime injection instead.