MediumSecrets & credentialsBLWK-CRED-003

Docker registry logins are stored in the config file

What this means

Docker saved ‹inline auths› registry login(s) inside ‹path›. They look scrambled, but it is only base64 encoding, not encryption: anyone who can read the file can decode your username and password or token in seconds.

How to fix it

Let Docker keep registry logins in your computer's keychain.

1. Install Docker's credential helper (golang-docker-credential-helpers on Ubuntu; built in on macOS and Windows, and Docker Desktop sets it up for you).
2. In ‹path›, set “credsStore” to “secretservice” (Linux), “osxkeychain” (macOS) or “wincred” (Windows).
3. Delete the entries under “auths”, then run docker login again for each registry.
4. Rotate any registry token that was stored in the file.

Check it yourself

Run a scan and look for BLWK-CRED-003 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads credential_stores and reports this check when:

kind == "docker_config" and inline_auths > 0 and creds_store == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1552.001

Related checks

• A long-lived AWS access key is stored on disk · BLWK-CRED-001
• Git stores passwords and tokens in plain text · BLWK-CRED-002
• A credential file can be read by other users · BLWK-CRED-004
• SSH private key is not passphrase-protected · BLWK-SSH-012
• SSH private key passphrase status could not be determined · BLWK-SSH-013
• A secret is exposed in AI assistant context · BLWK-AI-001