Thousands of images on Docker Hub leak auth secrets, private keys - eviltoast
  • corytheboyd@kbin.social
    link
    fedilink
    arrow-up
    15
    ·
    edit-2
    1 year ago

    I’m sure plenty of the offenders are legitimate, but it’s completely safe to check private key pairs into code, or to bake them in to images. It entirely depends on what the key pairs are used for. Very common to include key pairs for development/test environments, for example. If it’s a production secret, of course you don’t do this.

    • andrew@lemmy.stuart.fun
      link
      fedilink
      arrow-up
      9
      ·
      1 year ago

      You’re right in one sense but when you get to the last sentence your argument breaks down.

      The same type of secret should be treated the same way. The problem with treating environments different is that it builds bad habits especially for new devs who come in and see it being done in a certain way. But also, humans screw up and it’s better to just build the habit of not committing anything private outside of prod-like credential stores even if it’s not the prod instance.

      • deejay4am@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        Yeah, exactly. Don’t allow it anywhere, way less chance someone forgets to remove them from the prod build.