Layerleak emerges as a specialized Docker Hub secret scanner designed to analyze container image layers, config metadata, and history rather than treating images as flat blobs. The project addresses limitations in traditional scanners by focusing on OCI image internals, enabling more comprehensive security detection without requiring a local Docker daemon.

Current capabilities include manifest-aware and layer-aware scanning of public Docker Hub images, with support for both final filesystem artifacts and deleted layers. The tool scans image configuration metadata, environment variables, labels, and history while deduplicating findings by secret fingerprint. Unlike conventional approaches, layerleak can identify secrets across multiple contexts without Docker daemon dependencies.

Installation requires Go 1.24+ with optional Postgres persistence for storing findings. Users can run scans against public images via command line, with results saved in JSON format. The scanner handles multi-arch images and provides detailed metadata for each finding, including disposition status and line numbers to aid in triage and false-positive review.