A developer on your team suggests this approach:
1. Copy a file with an API key into the Docker image during build.
2. Use it to set up the app.
3. Delete the file in a later step.
Their conclusion: "The file won’t be in the final Docker image, so it’s safe."
You disagree. All layers of a Docker image are kept, so the API key is still there.
Your challenge: Find the API key hidden in the Docker image.




