The build is a privileged step that runs commands and pulls dependencies, often in CI on a host that also builds other projects. Two things go wrong there: secrets handed to the build persist in the image, and the build itself can be made to run attacker code on the build host.

Subtopics#

• Build-arg secret leak: secrets in build args and intermediate layers.
• BuildKit RCE: code execution on the build host.

References#

• Docker build secrets
• BuildKit