hard20 pts · first answer countsdockercontainer-securitysecrets-management

Deleted secret still in the image

This Dockerfile copies an npm token, uses it, then deletes it. A scan still finds the token in the pushed image. What is the right fix?

FROM node:22-alpine
WORKDIR /app
COPY .npmrc package*.json ./
RUN npm ci
RUN rm .npmrc
COPY . .

A.Run rm .npmrc in the same RUN line as npm ci, which removes it from every layer of the image.B.Pass the token with ARG NPM_TOKEN instead, because build args are never stored in the image.C.Squash the image after pushing it, so the registry drops the older layer that holds the file.D.Use a BuildKit secret mount (RUN --mount=type=secret,id=npmrc ...) so the token never lands in a layer.

Discussion 0

Join free to post in the discussion.

Deleted secret still in the image

Discussion 0

Related questions