If I add a secret file in my first layer, then use the secret file in
my second layer, and the finally remove my secret file in the third
layer, and then build with the --squash flag.
Will there be any way now to get the secret file?
Answer: Your image won't have the secret file.
How --squash works:
Once the build is complete, Docker creates a new image loading the diffs from each layer into a single new layer and references all the parent's layers.
In other words: when squashing, Docker will take all the filesystem layers produced by a build and collapse them into a single new layer.
This can simplify the process of creating minimal container images, but may result in slightly higher overhead when images are moved around (because squashed layers can no longer be shared between images). Docker still caches individual layers to make subsequent builds fast.
Please note this feature squashes all the newly built layers into a single layer, it is not squashing to scratch.
Side notes:
Docker 1.13 also has support for compressing the build context that is sent from CLI to daemon using the --compress flag. This will speed up builds done on remote daemons by reducing the amount of data sent.
Please note as of Docker 1.13 this feature is experimental.
Update 2024:
Squash has been moved to buildkit and later on deprecated from buildkit
WARNING: experimental flag squash is removed with BuildKit. You should squash inside build using a multi-stage Dockerfile for efficiency.
As the warning suggests you need to use multi-stage builds instead of squashing layers.
Example:
# syntax=docker/dockerfile:1
FROM golang:1.21
WORKDIR /src
COPY <<EOF ./main.go
package main
import "fmt"
func main() {
fmt.Println("hello, world")
}
EOF
RUN go build -o /bin/hello ./main.go
FROM scratch
COPY --from=0 /bin/hello /bin/hello
CMD ["/bin/hello"]
--squash, would the file be accessible somehow by reading the layers on file system? With a test I have made it says that the layers are "missing" which have the secret file in, I assume this means that the secret file cannot be accessed somehow by digging into the layers? – Itinerant