boostsecurityio / boostsecurityio/bagel

[Question] Docker is fine, but what about docker-helpers?

Open
#26 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
196
Forks
13
PR merge metrics
No merged PRs in 30d

Description

# Docker PR

They are a docker PR :
- https://github.com/boostsecurityio/bagel/pull/25

The PR looks for creds on known files.

The PR mention credentials helpers.

## Docker credentials helpers

Now, helpers is the "good" way to have docker secrets, but some (most?) helpers are "just" binaries that provide the password as cleartext.

The secrets itself is not in cleartext, but the helpers will do all the works to provide the clear password to docker.

Some helpers may require a manual validation, but most won't.

My old powershell stuff for reference:

- https://github.com/tr4l/misc/tree/master/PowerShell/Credential_Access/dockerpass

## The question

Should bagel run the known helpers that don't ask for user interaction ?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.