Resolved

Accidental inclusion of development secrets in Docker production image

Docker
Security
DevOps
Secrets Management
Azure

Docker production image incorrectly included a development-only configuration file despite relying on Azure Key Vault for secrets. This violated security best practices by introducing an unnecessary attack surface.

Issue

A production Docker image contained a development-only configuration file, specifically a .env.example file. While the application securely manages production secrets through Azure Key Vault, the presence of this file in the production container introduced risks such as configuration drift and increased attack surface.

Culprit

The issue stemmed from misconfigured build steps in the Dockerfile, where:

  • Development-specific files were not excluded from the final image.
  • No mechanism prevented .env.* files from being copied during the multi-stage build.
  • The build process assumed that non-application files would be filtered by default.

Solution

Dockerfile Adjustments

The build process was updated to:

  1. Explicitly exclude development configuration files.
  2. Only copy essential application files (e.g., source code, runtime scripts, dependency manifests).

Secrets Management Workflow

To ensure environment-specific secrets remain isolated:

  • Development: Local configuration files (e.g., .env.local) are ignored via .dockerignore and managed separately.
  • Production: Secrets are securely injected into containers via Azure Key Vault using the CSI driver, mounted as encrypted volumes to the application.

Validation

A build-time check was implemented to fail if any .env* files are detected in the final image, enforcing compliance with security policies.