Hardcoded credential in service environment

This product is not supported for your selected Datadog site. ().

Metadata

Id: dockercompose-hardcoded-credential-in-environment

Platform: DockerCompose

Severity: High

Category: Secret Management

Learn More

Description

Storing credentials such as passwords, API keys, or tokens as literal values in the environment section exposes them in version control, container inspect output, and process listings. Any developer, CI system, or attacker with read access to the Compose file or the running container can retrieve the credential. Sensitive values should be passed via Docker secrets (secrets:) or referenced as environment variable placeholders (e.g., DB_PASSWORD: ${DB_PASSWORD}) rather than hardcoded literals.

Compliant Code Examples

services:
  env_refs:
    image: alpine
    environment:
      DB_PASSWORD: ${DB_PASSWORD}
      API_KEY: $API_KEY
      AUTH_TOKEN: ${AUTH_TOKEN:?missing token}
      PRIVATE_KEY: ${PRIVATE_KEY?missing key}
      DB_PASSWORD_NESTED: ${DB_PASSWORD:-${FALLBACK_PASSWORD}}
      DB_PASSWORD_REF: ${DB_PASSWORD:-$FALLBACK_PASSWORD}
      DB_PASSWORD_UNSET: ${PRIMARY_PASSWORD-$FALLBACK_PASSWORD}
      DB_PASSWORD_NESTED_ERR: ${PRIMARY_PASSWORD:-${FALLBACK_PASSWORD:?missing}}
      DB_PASSWORD_NESTED_DEEP: ${PRIMARY_PASSWORD:-${SECONDARY_PASSWORD:-$LEGACY_PASSWORD}}
      DB_PASSWORD_EMPTY: ${DB_PASSWORD:-}
      DB_PASSWORD_ALT: ${DB_PASSWORD:+$FALLBACK_PASSWORD}
      DB_PASSWORD_ALT_UNSET: ${PRIMARY_PASSWORD+$FALLBACK_PASSWORD}
      DB_PASSWORD_ALT_NESTED: ${PRIMARY_PASSWORD:+${FALLBACK_PASSWORD}}
  no_creds:
    image: alpine
    environment:
      PORT: "8080"
      APP_NAME: myapp
      SECRET_NAME: database_password
      TOKEN_URL: https://auth.example.com/token
      GOOGLE_APPLICATION_CREDENTIALS: /run/secrets/gcp.json
      DB_PASSWORD_FILE: /run/secrets/db_password

Non-Compliant Code Examples

services:
  object_env:
    image: alpine
    environment:
      DB_PASSWORD: secret123
  list_env:
    image: alpine
    environment:
      - MYSQL_ROOT_PASSWORD=hunter2
  client_secret:
    image: alpine
    environment:
      CLIENT_SECRET: client-secret
  aws_secret_access_key:
    image: alpine
    environment:
      AWS_SECRET_ACCESS_KEY: access-key
  django_secret_key:
    image: alpine
    environment:
      SECRET_KEY: django-secret
  aws_access_key_id:
    image: alpine
    environment:
      AWS_ACCESS_KEY_ID: AKIAEXAMPLE
  compact_api_key:
    image: alpine
    environment:
      APIKEY: api-key
  rails_secret_key_base:
    image: alpine
    environment:
      SECRET_KEY_BASE: rails-secret
  fallback_literal:
    image: alpine
    environment:
      DB_PASSWORD: ${DB_PASSWORD:-supersecret}
  alt_literal:
    image: alpine
    environment:
      DB_PASSWORD: ${DB_PASSWORD:+supersecret}