Container images, layers, and deleted build-time secrets

Mechanism

Container images are layered filesystem snapshots plus configuration. Deleting a secret in a later layer can hide it from the final filesystem while leaving it in an earlier layer. Build arguments, environment values, history, and copied source files provide additional disclosure surfaces. Runtime secrets and build-time secrets have different storage paths.

Practical method

Inspect image configuration and history, then enumerate saved layers without executing the image. Trace file additions and whiteout deletions. Search only the scoped challenge paths and redact sensitive values in evidence. Compare the final filesystem with earlier layer contents.

docker image inspect lab-image
docker history --no-trunc lab-image
docker save lab-image -o lab-image.tar

Interpreting evidence

A deleted file in a lower layer remains part of that image artifact. Confirm the exact layer and file path and distinguish it from a runtime-mounted secret.

Pitfalls and limits

Multi-stage builds can remove build context from the final image when used correctly. Squashed exports differ from layered archives. Image history may reveal metadata without containing the original file bytes.