Secret written into the Dockerfile (ARCH10003)

Key config.docker.secret-in-image · Severity error · Category security · CWE CWE-798

A value written into an ENV or ARG stays in the image’s layers and build history: everyone who can pull the image can read it, long after the line was removed from the Dockerfile. The rule looks at names that end in a secret word (password, secret, token, API key, client secret, connection string) with a value written out.

Incorrect

FROM node:22.11-alpine
ENV DATABASE_PASSWORD=change-me-123
COPY . .
USER node
CMD ["node", "server.js"]

Correct

FROM node:22.11-alpine
# The password is mounted at run time (docker secret / Kubernetes Secret).
ENV DATABASE_PASSWORD_FILE=/run/secrets/db_password
COPY . .
USER node
CMD ["node", "server.js"]

Fix

Pass the value at run time (an environment variable of the container, an orchestrator secret) or as a build secret (RUN --mount=type=secret).

Not flagged

• A reference ($VAR, ${VAR}) and an empty value.
• Names that only mention a secret: PASSWORD_FILE, TOKEN_URL, CACHE_KEY.