Challenge 71 ☆

Welcome to challenge Challenge 71.

Dev Container Secret Leak

Development containers (Dev Containers) allow teams to define reproducible development environments using containerization tools like VS Code Remote - Containers and GitHub Codespaces. By encapsulating tools, runtimes, and dependencies within .devcontainer/devcontainer.json, developers can get started without installing complex local software stacks.

However, developers frequently make the mistake of embedding sensitive tokens, passwords, API keys, or private registry access credentials directly into .devcontainer/devcontainer.json (such as in containerEnv, remoteEnv, or lifecycle scripts) and committing them to version control.

To solve this challenge:

  1. Inspect the .devcontainer/devcontainer.json devcontainer configuration file in the project repository or review the configuration snippet in the UI.

  2. Identify the leaked DEVCONTAINER_SECRET or token defined in the container environment.

  3. Submit the discovered secret in the input field below.

💡 Tip: Secrets are often strings, numbers, or encoded values. Copy and paste exactly what you find.

You can solve this challenge using the following steps:

  1. Inspect the Dev Container configuration file:

  2. Inspect the running container environment:

    • Clone the repository to your computer.

    • Open the project in a devcontainer:

      1. In VS Code: Press Ctrl+Shift+P (or Cmd+Shift+P on macOS) → select "Dev Containers: Reopen in Container" (or click the prompt in the bottom-left corner).

      2. In Intellij Idea, click on the pop-up "open in devcontainer".

    • Once the project is opened in the devcontainer, check the environment variables with printenv DEVCONTAINER_SECRET or echo $DEVCONTAINER_SECRET.

Why Hardcoding Secrets in Dev Containers is a Critical Security Risk

Dev Containers are shared development environments configured via .devcontainer/devcontainer.json. Because these files are typically tracked in version control, hardcoding secrets into devcontainer definitions presents several security dangers:

  1. Exposure to All Repository Readers: Anyone with read access to the source repository (or public forks and clones in open-source projects) can read secrets hardcoded in .devcontainer/devcontainer.json.

  2. Environment Variable Leakage: Credentials defined in containerEnv or remoteEnv are injected into every process inside the container, making them accessible to any script, child process, or diagnostic tool running in the container.

  3. Persistent in Git History: Once committed, removing the secret requires git history rewrites, and stale keys often remain valid indefinitely if rotation is not performed.

  4. Harder to detect: Many secret & container inspectors do still not pick up the devcontainer.json as it behaves differently than a Dockerfile.

Remediation and Best Practices:

  • Use GitHub Codespaces Secrets / VS Code Dev Container Secrets: Inject secrets dynamically via Codespaces repository/user secrets or VS Code settings rather than hardcoding them in configuration files.

  • Use Local Environment Substitution: Reference host environment variables dynamically in devcontainer.json using ${localEnv:MY_SECRET} syntax.

  • Use .env files with .gitignore: Place development secrets in local .env files that are explicitly excluded from version control in .gitignore.

  • Adopt Secret Management Solutions: Fetch secrets at runtime using dedicated secret managers (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager).


⬅️ Previous
🏠 Main Page
Next ➡️
0