Can build args used for a Docker image be extracted from it?

  docker, docker-buildkit

There are claims that build arguments of a Docker image can be extracted after you pull the image (example).

I’ve tested this with the following Dockerfile:

FROM scratch

ARG SECRET

ADD Dockerfile .

When I build the image:

$ docker build -t build-args-test --build-arg SECRET=12345 .

And inspect it as specified in the article:

$ docker image history --no-trunc build-args-test
IMAGE                   CREATED          CREATED BY                    SIZE      COMMENT
sha256:(hash omitted)   17 minutes ago   ADD Dockerfile . # buildkit   43B       buildkit.dockerfile.v0
<missing>               17 minutes ago   ARG SECRET                    0B        buildkit.dockerfile.v0

I can’t see the actual build argument (12345).

Is there a way to extract the build arguments from the image?

Would the answer be different if the image is not built on my machine but pulled from a repository?

I am aware of the Docker build secret functionality. However, I am asking specifically about ARG.

Source: Docker Questions

LEAVE A COMMENT