Rules / GL029

GL029 docker login with -p flag instead of --password-stdin

Severity: warn
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene

What glsec checks

glsec flags script lines that run docker login with the -p (short password) flag. Passing the password as a command-line argument makes it visible in the process table (ps aux) for the lifetime of the command, readable by any other process on the same runner host. Shell history and CI debug traces may also capture it.

Trigger example

deploy:
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY

Safe alternative

deploy:
  script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login --password-stdin -u $CI_REGISTRY_USER $CI_REGISTRY

--password-stdin reads the password from stdin, keeping it out of the process table and shell history.

References

• Docker docs: docker login --password-stdin
• GL006: hardcoded secret in variables: block
• GL027: secret-like variable with a value committed in the pipeline file

See also

Enable the ShellCheck integration to surface additional shell issues in these script blocks.

Documentation for glsec 1.23.0. Source of this page · Rule implementation