Layerleak: Docker Hub Secret Scanner Tool Documentation
By
brumbelow
Pulled from the oven just right. Trustworthy, fact-dense, deeply satisfying.
Summary
Layerleak is a Docker Hub secret scanner tool that detects sensitive information in Docker images. The article provides technical documentation on installation, configuration, and usage, including prerequisites, building from source, environment configuration, and database setup. It explains how the tool writes findings to JSON files and can optionally store results in a database.
Key quotes
· 5 pulledlayerleak the Docker Hub Secret Scanner
If LAYERLEAK_FINDINGS_DIR is not set, layerleak writes JSON findings files to findings/ under the repo root
Saved findings files contain only detections, including unredacted finding values and unredacted context snippets
LAYERLEAK_TAG_PAGE_SIZE controls Docker Hub tag-list pagination for repository-wide scans
If LAYERLEAK_DATABASE_URL is set, the scanner also writes the scan to
You might also wanna read
Composer vulnerability leaks GitHub Actions GITHUB_TOKEN in logs due to format mismatch
A security vulnerability has been identified where Composer leaks the full contents of GitHub OAuth tokens (specifically GITHUB_TOKEN) to st
github.com·18d ago
Copy-Fail-Destroyer: A Kubernetes DaemonSet Agent for Detecting and Remediating Linux Kernel CVE-2026-31431
A Kubernetes DaemonSet agent called "copy-fail-destroyer" that detects and remediates CVE-2026-31431 ("Copy Fail"), a Linux kernel vulnerabi
github.com·1mo ago
FIPS Compliance Challenges in Containerized Applications: Why Base Images Aren't Enough
The article discusses the challenges of achieving FIPS (Federal Information Processing Standards) compliance in containerized applications,
docker.com·4mo ago
lockenv: Password-Based Encrypted Vault for .env and Infrastructure Secrets
lockenv is a simple, password-based encrypted vault tool for securely storing sensitive files like .env files and infrastructure secrets in
github.com·5mo ago
Kekkai: A Go-Based File Integrity Monitoring Tool for Security Protection
Kekkai is a lightweight Go tool designed for file integrity monitoring that detects unauthorized file modifications by comparing content-bas
github.com·8mo ago
Keeping Secrets Out of Logs: A Defense-in-Depth Approach
This article discusses strategies for preventing sensitive data (secrets, credentials, PII) from being written to application logs. The auth