Exposed container registry

When it applies

A Docker/OCI registry is reachable — a self-hosted registry (:5000, /v2/), or a cloud one (ECR/GCR/ACR/Harbor) with weak auth. Images are goldmines: source, configs, and baked-in secrets.

Why it works

Registries are often deployed without auth ("internal only") or with over-broad pull access. Image layers preserve everything added at build time — .env files, cloud keys, private source, tokens — even if a later layer deletes them, earlier layers keep them.