Guardrails / iac

Dockerfiles declare no credential arguments

iac/dockerfile-no-build-secrets@v1

No ARG or ENV a Dockerfile declares is named like a credential.

Id	iac/dockerfile-no-build-secrets
Version	v1
Category	iac
Default severity	error
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	docker

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

Collector	Gathers	Inputs it is given
docker	Every Dockerfile in the tree, parsed without a tool: the stages it builds, the image each one starts from and how that image is pinned, the user the image ends as, the ports it exposes, the paths it copies in and the names of the build arguments and environment variables it declares, enriched with the findings of a hadolint report when the build already left one behind.	none

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "iac/dockerfile-no-build-secrets@v1",
              "severity": "error",
              "with": {
                  "patterns": "*SECRET*,*TOKEN*,*PASSWORD*,*KEY*,*CREDENTIAL*"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
patterns	Comma separated glob patterns, matched without regard to case. Each one is matched against the name of every ARG and every ENV. Names only, because the collector carries no values, which is what makes these facts safe to attach to a build.	*SECRET*,*TOKEN*,*PASSWORD*,*KEY*,*CREDENTIAL*	GUARDRAIL_INPUT_PATTERNS

How to fix

Take the credential in at build time with a secret mount, which leaves nothing in the image:

RUN --mount=type=secret,id=npm_token \
    NPM_TOKEN=$(cat /run/secrets/npm_token) npm ci

docker build --secret id=npm_token,env=NPM_TOKEN .

An ARG is recorded in the image history and docker history prints it. An ENV stays in the image and docker inspect prints it. Either way the value reaches everyone who can pull the image, and a value that reached a registry is rotated rather than deleted.

This guardrail sees names, never values: the collector carries neither the default beside an ARG nor the value beside an ENV. A name that says TOKEN is enough to have the credential rotated.

More in iac

• iac/dockerfile-base-pinned. Every image a Dockerfile builds from is pinned to a digest, so a rebuild of the same commit starts from the same bytes.
• iac/dockerfile-healthcheck. Every Dockerfile declares a HEALTHCHECK, so the orchestrator can tell a container that is running from one that is working.
• iac/dockerfile-lint-clean. Every finding the Dockerfile linter reported sits below the severity the team gates on.
• iac/dockerfile-nonroot-user. Every Dockerfile ends on a USER that is not root, so the container runs its process unprivileged.
• iac/terraform-modules-pinned. Every module a Terraform root takes from a registry or a git URL names the version it takes, so the same commit resolves to the same module twice.
• iac/terraform-no-plaintext-secrets. Every Terraform variable named like a credential declares sensitive = true.
• iac/terraform-providers-pinned. Every provider a live Terraform root requires is pinned to one exact version, and the lock file that resolves them is committed.
• iac/terraform-remote-state. Every live Terraform root stores its state in a remote backend, and no state file is left in the checkout.

All 11 iac guardrails