Lion Cipher Lab
Recover a "deleted" secret from Docker image layers — then keep it out with BuildKit secret mounts
- Cloud Security
- Intermediate
- ~40 min
- Free · no account required
Why it matters
A huge share of real credential leaks are not fancy hacks — someone baked an API token into a container image and shipped it to a registry anyone can pull. The dangerous part is that it FEELS safe: you add the file, use it, then `rm` it in the next line and the final container has no trace. But a Docker image is a stack of frozen layers, and deleting a file only hides it — the layer that added it is still there for anyone with the image. Learning to pull that secret back out yourself is the fastest way to never make the mistake, and the fix (build secrets) is one line.
What you'll learn
- Docker image internals (how layers really work)
- secret hygiene in container builds
- BuildKit build secrets (--mount=type=secret)
- multi-stage builds
- image forensics with docker history, inspect, and save
- supply-chain security judgment
Steps in this lab
- Why secrets get stuck in images (read this first)
- Set up a tiny project with a secret
- Build the image the naive (leaky) way
- Confirm the file is 'gone' at runtime — then watch it reappear in the metadata
- Recover the 'deleted' file out of the layers
- Fix it properly: a BuildKit secret mount
- A second line of defense: multi-stage builds
- Re-measure: prove the secret is gone
- When to use what — the judgment to keep