Supply Chain

The Docker Instruction That Runs on Your Machine, Not Theirs

June 9, 2026 No comments yet

There is a Docker instruction that runs automatically during your build. You do not know it is there. And it can steal every secret you have.

The instruction is called ONBUILD. Most developers have never heard of it. Which is exactly what makes it dangerous.

So what is it?

When somebody builds a Docker image and puts an ONBUILD instruction inside it, that instruction does not run for them. It runs for you. The moment you FROM that image, the instruction comes to life and runs inside your build. Silently. With no sign at all. With no line in your own Dockerfile.

Now think about that for a second.

Somebody you do not know uploaded an image to Docker Hub. You did a FROM on it because it looked convenient. And at build time it ran a script inside your environment that took every environment variable: GitHub tokens, AWS keys, CI/CD secrets. All of it.

Do you know what happens when somebody gets your GitHub token? They get into the repo. They change code. They inject a backdoor. They push to production.

This is not theory. It is a classic supply chain attack, and one of the simplest to pull off.

The maddest part is that most teams docker pull some popular image and simply trust it. Without checking what is inside. Without reading the original Dockerfile. Without looking for ONBUILD instructions. It is like letting an unknown contractor into the office, handing them every key, and going home – then being surprised something is missing.

So what do you do?

  • Inspect every base image before you use it. Run docker inspect and look for ONBUILD triggers. If there is something there you cannot explain, it should not be there.
  • Pin images by SHA256, not by tag. A latest tag can change at any moment, and someone can overwrite it with a malicious version. A SHA256 hash cannot be forged.
  • Build your own internal base images. Yes, it is work. It is work that saves you the conversation with the lawyers after a breach.

I see this at clients constantly. Development teams moving fast, copy-pasting a Dockerfile off Stack Overflow, and nobody stopping to ask the basic question: what is actually running here?

I first shared a version of this as a LinkedIn post on 2026-06-09. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula