DevOps Engineer interview question · Most asked
A Dockerfile copies a .env file, uses it, and deletes it in a later RUN step. Is the secret safe?
Summary
No. Each instruction creates a layer and the file remains in the layer that added it; the deletion only hides it in later layers. Anyone who can pull the image can extract it. Rotate the secret, exclude it with .dockerignore, and use BuildKit secret mounts.
Longer Answer
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm ci exposes the secret only to that step. Combine with short-lived credentials (OIDC) in CI and secret scanning on images and repositories.
Key Points
- Layers keep deleted files.
- Rotate anything exposed.
- .dockerignore and BuildKit secret mounts.
- Short-lived credentials; scanning.
Deep dive: DevOps in Production: The Key in the Image
Explanation
What interviewers look for
Knowing how layers work and the correct remediation order (rotate first).
More most-asked DevOps Engineer questions
- Design a CI/CD pipeline for a containerised microservice from commit to production.
- Pods keep restarting with OOMKilled under load. How do you investigate and fix it?
- How do you handle database schema migrations in an automated deployment pipeline?
- How do you handle secrets in CI/CD pipelines securely?
- What happens when you type a URL into a browser and press Enter?
- A rollback after a release made the outage worse because the database had already been migrated. How do you design releases so rollbacks are always safe?
- What are DORA metrics, and how would you use them without gaming them?
- Every deployment produces a burst of 502s. What do you check?