Forensics · warm-up
Somebody's credentials shipped
This image was pushed to a public registry last week. Security says a credentials file is in it. The team says they delete it in the Dockerfile, and they do — you can see the file is not in the running container. Find what is still in the image.
The question
Which path is absent from the filesystem and still present in the image?
The image
- Image id
- sha256:58cc8e00c776
- Layers
- 8
- History
- 9
- Size
- 237.8 MB
- modelled
8 paths
| Path | Introduced | State | Size |
|---|---|---|---|
| / | 0 | present | 0 B |
| /app | 1 | present | 0 B |
| /app/.env.example | 4 | present | 40 B |
| /app/dist | 6 | present | 6 B |
| /app/node_modules | 5 | present | 228.9 MB |
| /usr/bin/ca-certificates | 2 | present | 312.5 KB |
| /usr/bin/curl | 2 | present | 1.1 MB |
| /usr/lib/base | 0 | present | 7.4 MB |