PG003: Avoid copying sensitive files into the image
Warning Security
Why This Matters
Copying sensitive files like private keys, .env files, or credentials into a Docker image embeds them in the layer history. Even if you delete them in a later step, they can still be extracted from earlier layers. Anyone with access to the image can pull out your secrets. Use .dockerignore to exclude sensitive files, mount secrets at runtime, or use Docker build secrets (--mount=type=secret).
How to Fix
Add sensitive files to .dockerignore and use build secrets or runtime mounts
Before (incorrect)
COPY .env /app/.env
COPY id_rsa /root/.ssh/id_rsaAfter (correct)
# Add to .dockerignore: .env, id_rsa
# Use build secret instead:
RUN --mount=type=secret,id=env,target=/app/.env cat /app/.envRule Details
- Rule Code
- PG003
- Severity
- Warning
- Category
- Security