87

In Docker 1.13 the new --squash parameter was added.

I'm now hoping to reduce the size of my images as well as being able to "hide" secret files I have in my layers.

Below you can now see the difference from doing a build with and without the --squash parameter.

Without Squash

enter image description here

With Squash

enter image description here

Now to my question.

If I add a secret file in my first layer, then use the secret file in my second layer, and the finally remove my secret file in the third layer, and then build with the --squash flag.

Will there be any way now to get the secret file?

Community
  • 1
  • 1
Fore
  • 5,726
  • 7
  • 22
  • 35

1 Answers1

96

If I add a secret file in my first layer, then use the secret file in my second layer, and the finally remove my secret file in the third layer, and then build with the --squash flag.

Will there be any way now to get the secret file?

Answer: Your image won't have the secret file.

How --squash works:

Once the build is complete, Docker creates a new image loading the diffs from each layer into a single new layer and references all the parent's layers.

In other words: when squashing, Docker will take all the filesystem layers produced by a build and collapse them into a single new layer.

This can simplify the process of creating minimal container images, but may result in slightly higher overhead when images are moved around (because squashed layers can no longer be shared between images). Docker still caches individual layers to make subsequent builds fast.

Please note this feature squashes all the newly built layers into a single layer, it is not squashing to scratch.

Side notes:

Docker 1.13 also has support for compressing the build context that is sent from CLI to daemon using the --compress flag. This will speed up builds done on remote daemons by reducing the amount of data sent.

Please note as of Docker 1.13 this feature is experimental.

Ry-
  • 218,210
  • 55
  • 464
  • 476
Farhad Farahi
  • 35,528
  • 7
  • 73
  • 70
  • 4
    If you were to do this without `--squash`, would the file be accessible somehow by reading the layers on file system? With a test I have made it says that the layers are "missing" which have the secret file in, I assume this means that the secret file cannot be accessed somehow by digging into the layers? – BeefCake Jul 01 '20 at 17:35
  • 4
    If you published or distributed the image, yes, someone could get into one of the other layers and look at the secret file. Ever notice how when you pull a Docker image you'll sometimes see it pulling several layers? You'll notice each layer has a hash ID - you can actually use those hash IDs directly to launch containers from any layer in the stack. From there a user could override entrypoint and command, get a shell and poke around. (Or they could just go look in the /var/lib/docker folder and poke around there.) – fdmillion Apr 08 '21 at 20:35
  • 5
    For anyone landing here and wondering why they do not see `--squash` among the options shown for `docker build --help`, you need to turn on experimental features for the daemon. On typical Linux installs, edit `/etc/docker/daemon.json` and add `"experimental": true` at the end of the block. Restart the docker daemon for it to take effect. How to do that depends on the Linux distro, `sudo systemctl restart docker` for Ubuntu/debian. For Mac OS X, the JSON to edit can be found in the Docker Engine section of the preferences control panel, click the gear icon at the upper right of desktop app. – slowkoni Aug 05 '22 at 18:58
  • For _rootless_ docker the `"experimental": true` should be in `~/.config/docker/daemon.json` file – user2380383 Dec 09 '22 at 12:45