CI for a utility-billing image currently COPY’s a database password into a layer “just for tests.” What is the sound testing posture?
Select an answer to reveal the explanation.
Short Explanation
Twelve-factor config applies to the test run too. Passwords and tokens come from the environment or Vault—not from a COPY’d layer that will fail or leak in the next tenancy.
Full Explanation
Twelve-factor configuration applies to the test run as much as to production. CI for a utility-billing image should externalize fixtures and credentials via environment variables or OCI Vault in higher environments rather than COPY’ing a database password into an image layer “just for tests.” Baked secrets leak into registries, break least privilege across tenancies, and make rotation painful when the next environment needs different credentials.
Baking production-like passwords into every image layer so tests always pass offline fails by concept: the artifact becomes a secret store and travels wherever the image is pulled. Committing live tenancy tokens into Dockerfile ENV so local and CI share one secret fails for the same reason and spreads blast radius. Embedding citizen PII sample dumps in the base image so every suite has identical data forever fails privacy and data-minimization expectations—use synthetic fixtures injected at run time instead.
Exam caveat: “test realism” does not justify baking secrets into layers; inject config at runtime. Operational check: remove passwords from the Dockerfile, pass credentials via CI secrets or Vault into the test container environment, and confirm the image layers contain no credential strings when scanned.