FDE ForgeBeta
Start free
Week 4 · Foundation

No keys in the image

0:00 / 3:00

20 seconds

The key was in layer 4.

A JSON service-account file was COPY'd into the image. Anyone who pulls it owns Northwind's bucket.

Imagekey.jsonRegistryPullableLeakForever
Lesson notesNo keys in the image: the short version+

Week 4 · Cloud & containers · about 3 minutes

What you will be able to do

Authenticate to cloud APIs with workload identity instead of baking a JSON key into the container.

The idea

Files in an image are public to everyone who can pull that tag — now and in old layers. Keys do not belong there.

Use workload identity: the platform attaches a cloud role to the running task. No JSON file. No long-lived key in CI either.

# Do not do this
COPY ./sa-key.json /secrets/sa-key.json
ENV GOOGLE_APPLICATION_CREDENTIALS=/secrets/sa-key.json

If the key is in the image, assume it is already stolen.

Key takeaways

  • Never COPY cloud keys into an image.
  • Prefer workload identity / IRSA / attached roles.
  • Rotate anything that ever touched a layer.

Part of the Forward Deployed Engineer roadmap. New to the role? Start with what a Forward Deployed Engineer does.