rspec/rules/S6472/docker/rule.adoc

include::../description.adoc[]

include::../ask-yourself.adoc[]

include::../recommended.adoc[]

== Sensitive Code Example

[source,docker]
----
FROM example
# Sensitive
ARG ACCESS_TOKEN
# Sensitive
ENV ACCESS_TOKEN=${ACCESS_TOKEN}
CMD /run.sh
----

== Compliant Solution

For build time secrets, use https://docs.docker.com/engine/reference/builder/#run---mounttypesecret[Buildkit's secret mount type] instead:
[source,docker]
----
FROM example
RUN --mount=type=secret,id=build_secret ./installer.sh
----

For runtime secrets, leave the environment variables empty until runtime:

[source,docker]
----
FROM example
ENV ACCESS_TOKEN=""
CMD /run.sh
----

Store the runtime secrets in an https://docs.docker.com/compose/env-file/[environment file] (such as `.env`) and then start the container with the https://docs.docker.com/engine/reference/commandline/run/#set-environment-variables--e---env---env-file[`--env-file`] argument:

[source,text]
----
docker run --env-file .env myImage
----

include::../see.adoc[]

include::../implementation.adoc[]