Repair Docker BuildKit Secret Cache Exposure

Repair Docker BuildKit Secret Cache Exposure — EVIDENCE-LIMITED REVIEW

Scenario received

A container build accidentally copies a temporary credentials file into an image stage.

Evidence inventory

• S1: Dockerfile build stages — partial extract described by the requester; original full source not provided here.
• S2: BuildKit build log excerpts — partial extract described by the requester; original full source not provided here.
• S3: image layer metadata — NOT PROVIDED; required to validate dependent findings.
• S4: CI secret mount configuration — NOT PROVIDED; required to validate dependent findings.

Case-specific checks

Trace secret mount lifespan. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
2.

Inspect copy and export paths. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
3.

Flag cache persistence risks. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
4.

Propose controlled proof tests. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.

Deliverables

Credential exposure evidence grid. Create an evidence-linked section with observations, missing data, owner and next validation step.

Hardened build patch. Create an evidence-linked section with observations, missing data, owner and next validation step.

Image artifact validation checklist. Create an evidence-linked section with observations, missing data, owner and next validation step.

Acceptance gate

The response avoids printing actual secrets and requires key rotation decisions by owners. Do not label this gate passed until supplied source records actually demonstrate it.

Verdict and next action

INCOMPLETE — evidence required. Request S3 and S4 from the authorized owner, reconcile them with S1 and S2, then repeat the four checks and log remaining conflicts. No production change, approval, communication, or test run is claimed.