Fresh Secrets From the Docks: Lessons Learnt From Analyzing 180,000 Public DockerHub Images
Talkat KubeCon + CloudNativeCon Europe 2025 · on Friday, 2025-04-04· at 14:30· Level 1 | Hall Entrance S10 | Room D·
summary
Analysis scans 180,000 public DockerHub images and finds 35,000 secrets in 18,000 images, with over 6,000 valid at test time (AWS, GCP, OpenAI, GitHub). The pipeline uses Docker Registry API enumeration, Scopio to extract blobs and ggshield for detection, focuses on COPY/ADD layers under 45 MB to reduce volume, and takes weeks to run. Key results: ~5% of repositories contain secrets, ~20% of specific detectors yield valid credentials, cloud keys and database credentials are common, and build args often leak secrets so secret mounts are required.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:45GitGuardian’s secrets detection mission
- 2:49Attacker goals and registry targets
- 3:54Docker image structure
- 6:25Scanning Docker images for secrets
- 8:13Methodology for registry scans
- 9:57Discovery challenges and results
- 11:22Filtering layers to reduce size
- 13:51Optimizing scan focus
- 15:14Secret detection and validation
- 17:17Secrets in Docker Hub findings
- 19:25Responsible disclosure
- 20:11Longevity of leaked secrets
- 21:15Docker build pitfalls
- 23:43Best practices for secrets in Docker
- 25:07Secrets in run layers
- 26:51Conclusion
related talks
32mContainers Don't Keep Secrets: Scanning Docker Hub for Leaked Credentials and Private Keys.
30mBelow the Radar: Identifying Hidden Threats Within the Development Ecosystem
33mGaining initial access by exploiting leaked credentials
48mHow Source Code is Revealing our Secrets
30mWhoops! I Accidentally Leaked My Credentials (again)
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
33mWhoops! I Accidentally Leaked My Cloud Keys
31mExploiting Leaked Credentials - How python code is leaking millions of secrets