Migrate to build containers for wrongsecrets

[commjoen]

In order to reduce dependency on the java version used, we should have a build/development container which as base layer contain JDK22 and the wrongsecrets-binaries. and have a challenge in which a secret is injected from that build container.

[za]

Hi @commjoen typo on the title.

contianers -> containers

[za]

Hi @commjoen are you referring to this build container?

A build container is a container that is created by every instruction in the Dockerfile (at least it was the case). When you use the RUN instruction, it creates a container, runs the command, commits the container to an image layer.

https://forums.docker.com/t/what-is-a-build-container/141421

[commjoen]

no a bit wider: a container that is used to do the development from as well.

[sandeshkuldharme1]

Hi @commjoen, I'd like to work on this issue! My proposed plan:
1.Add .devcontainer configuration with JDK 22 base image and preloaded wrongsecrets-binaries.
2.Update the multi-stage build container to decouple the build environment from the host machine.
3.Implement Challenge XX demonstrating secret leakage from build-container intermediate stages / build-args.
Does this structure align with your expectations for this issue?

[commjoen]

hi @sandeshkuldharme1 , that will have to be jdk 26 then ;-) , but the rest: LGTM, and it should work with tooling like idea-intellij (CE and commercial) and visual studio code. The rest: LGTM! Have fun :)