Jenkins Credential Decryptor - Docker Deployment

Optimized Docker container for forensic credential extraction with enhanced security and minimal footprint.

Features

• Minimal Size: <50MB final image using multi-stage Alpine build
• Security Hardened: Non-root execution, read-only rootfs, no capabilities
• Forensic Integrity: Read-only data mounts, pre-execution safety checks
• Network Isolated: No network access by default (network_mode: none)
• Resource Limited: CPU and memory constraints for controlled environments

Quick Start

Build the Image

cd docker/
docker-compose build

Extract Credentials from Jenkins Files

1. Place Jenkins files in jenkins_files/ directory:

   mkdir -p jenkins_files output
   # Copy your Jenkins files:
   # - master.key
   # - hudson.util.Secret
   # - credentials.xml (optional)

2. Run the decryptor:

   # View help
   docker-compose run --rm jenkins-decrypt --help
   
   # Decrypt and display (sanitized by default)
   docker-compose run --rm jenkins-decrypt --path /data
   
   # Decrypt and export to JSON
   docker-compose run --rm jenkins-decrypt --path /data --export-json /output/loot.json
   
   # Decrypt with revealed secrets
   docker-compose run --rm jenkins-decrypt --path /data --export-json /output/loot.json --reveal-secrets
   
   # Export to CSV
   docker-compose run --rm jenkins-decrypt --path /data --export-csv /output/loot.csv --reveal-secrets

Security Features

Non-Root Execution

Container runs as user forensic:forensic (UID:GID 1000:1000), not root.

Read-Only Root Filesystem

read_only: true

Prevents any modifications to container filesystem, ensuring forensic integrity.

Capability Dropping

cap_drop:
  - ALL

Removes all Linux capabilities, minimizing attack surface.

Network Isolation

network_mode: none

No network access required or allowed. Pure local file processing.

Resource Limits

limits:
  cpus: '0.5'
  memory: 128M

Controlled resource usage for restricted environments.

Volume Mounts

/data (Read-Only)

Mount your Jenkins files here:

volumes:
  - ./jenkins_files:/data:ro

The :ro flag ensures forensic integrity - no modifications possible.

/output (Writable)

Export decrypted credentials here:

volumes:
  - ./output:/output

/tmp (Tmpfs)

Temporary filesystem for Python bytecode when using read-only rootfs:

- type: tmpfs
  target: /tmp
  tmpfs:
    size: 10M

Entrypoint Safety Checks

The entrypoint script performs pre-execution validation:

1. User Check: Warns if running as root
2. /data Existence: Verifies mount point exists
3. /data Write Status: Warns if not read-only
4. File Discovery: Checks for master.key, hudson.util.Secret, credentials.xml
5. Export Path: Validates export directory is writable

Jenkins Lab Testing (Optional)

Start a Jenkins lab environment for testing:

# Start Jenkins lab
docker-compose --profile lab up -d jenkins-lab

# Wait for startup (2-3 minutes)
docker-compose logs -f jenkins-lab

# Access at http://localhost:8080

# Extract credentials from running Jenkins
docker exec jenkins-lab-target cat /var/jenkins_home/secrets/master.key > jenkins_files/master.key
docker exec jenkins-lab-target cat /var/jenkins_home/secrets/hudson.util.Secret > jenkins_files/hudson.util.Secret
docker exec jenkins-lab-target cat /var/jenkins_home/credentials.xml > jenkins_files/credentials.xml 2>/dev/null

# Run decryptor against extracted files
docker-compose run --rm jenkins-decrypt --path /data --export-json /output/loot.json --reveal-secrets

Advanced Usage

Custom Dockerfile Location

docker build -f docker/Dockerfile -t jenkins-decrypt:custom ..

Override Entrypoint (Skip Safety Checks)

docker-compose run --rm --entrypoint jenkins-decrypt jenkins-decrypt --help

Interactive Shell (Debugging)

docker-compose run --rm --entrypoint /bin/sh jenkins-decrypt

Multi-Architecture Builds

docker buildx build --platform linux/amd64,linux/arm64 -t jenkins-decrypt:multi -f docker/Dockerfile ..

Image Size Optimization

The multi-stage build achieves minimal size through:

1. Builder Stage: Uses Alpine with build dependencies (gcc, musl-dev)
2. Final Stage: Copies only virtual environment, no build tools
3. Python Alpine: Base image ~45MB vs ~120MB for python:slim
4. No Cache: pip install --no-cache-dir removes package caches
5. Minimal Dependencies: Only pycryptodome required (pure crypto, no web frameworks)

Expected final size: ~40-48MB

Security Scanning

Scan the image for vulnerabilities:

# Using Trivy
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/trivy image jenkins-credential-decryptor:2.0.0

# Using Grype
grype jenkins-credential-decryptor:2.0.0

Troubleshooting

"No Jenkins credential files found in /data"

Ensure files are mounted correctly:

ls -la jenkins_files/
# Should show: master.key, hudson.util.Secret, credentials.xml

"Export directory is not writable"

Check output directory permissions:

chmod 755 output/
chown 1000:1000 output/  # Match container user

"Cannot write to read-only root filesystem"

This is expected and secure. Ensure you're mounting /output for exports:

volumes:
  - ./output:/output

Production Deployment

For production forensic operations:

1. Use read-only data mounts (:ro flag)
2. Enable logging to capture all operations
3. Set resource limits appropriate to environment
4. Disable network (default configuration)
5. Scan image before deployment
6. Use specific version tags, not latest

Example:

docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges:true \
  --network=none \
  -v ./jenkins_files:/data:ro \
  -v ./output:/output \
  -v /tmp \
  jenkins-credential-decryptor:2.0.0 \
  --path /data --export-json /output/loot.json

License

MIT License - See LICENSE file