[HN Gopher] Show HN: Layerleak - Like Trufflehog, but for Docker...
       ___________________________________________________________________
        
       Show HN: Layerleak - Like Trufflehog, but for Docker Hub
        
       Author : brumbelow
       Score  : 6 points
       Date   : 2026-03-26 19:26 UTC (3 hours ago)
        
 (HTM) web link (github.com)
 (TXT) w3m dump (github.com)
        
       | brumbelow wrote:
       | I couldn't find anything comparable to Trufflehog for Docker
       | images, even though I have constantly read articles about
       | "secrets discovered in public images." So I built my own
       | (hopefully) comparable tool.
        
         | captn3m0 wrote:
         | But trufflehog supports docker images already? The trufflehog
         | readme has examples[0]                   # to scan from a
         | remote registry         trufflehog docker --image
         | trufflesecurity/secrets          # to scan from the local
         | docker daemon              trufflehog docker --image
         | docker://new_image:tag              # to scan from an image
         | saved as a tarball         trufflehog docker --image
         | file://path_to_image.tar
         | 
         | [0]: https://github.com/trufflesecurity/trufflehog#11-scan-a-
         | dock...
        
           | brumbelow wrote:
           | That's true, but as you can see from your paste, Trufflehog
           | requires the docker daemon and is generally pretty resource
           | intensive while scanning.
           | 
           | layerleak has neither of those issues or requirements.
           | 
           | Try it and let me know what you think.
        
             | KomoD wrote:
             | > That's true, but as you can see from your paste,
             | Trufflehog requires the docker daemon and is generally
             | pretty resource intensive while scanning.
             | 
             | Nothing in his message says it requires the docker daemon?
             | it says it can scan an image from a docker daemon if you
             | want.
             | 
             | I just tried myself and it doesn't require docker at all,
             | you don't need anything docker related even installed on
             | the system.
             | 
             | I tried them both to compare:
             | 
             | - trufflehog: 19 seconds
             | 
             | - layerleak: 26 seconds
        
       | darknavi wrote:
       | A small ask: Don't have the main tag like for your product refer
       | to another product. I know what Docker Hub is, but I have no idea
       | what Trufflehog is.
       | 
       | The first like of the GitHub README is much better IMO: layerleak
       | the Docker Hub Secret Scanner
        
         | brumbelow wrote:
         | Thanks for the advice! Did not even consider that. I just
         | updated it
        
       ___________________________________________________________________
       (page generated 2026-03-26 23:01 UTC)