In our CI pipeline, we use build secrets to inject secrets for our internal registries into our Dockerfile. However, the devcontainer CLI currently doesn't support using those secrets from within a feature. This limitation exists because the synthesized Dockerfile for building features requires additional parameters like --mount=type=secret,id=aws.
I created a PR that addresses this issue and allows providing secrets to features in the same way as with a regular docker buildx command. Here's an example of how it works:
In the feature install.sh:
#!/bin/bashset -e
if [ -f /run/secrets/compose_file ];thenecho"Contents of secret file:"
cat /run/secrets/compose_file
echo"Writing secret file contents to /secret_file.txt"
cat /run/secrets/compose_file > /secret_file.txt
elseecho"Secret file not found!"exit 1
fi
On the terminal:
devcontainer build --workspace-folder test-build-secrets --build-secret id=compose_file,src=./my_cred.txt --image-name test-build-secrets-image --no-cache
docker run --rm --entrypoint="cat" test-build-secrets-image /secret_file.txt
This will build the devcontainer with the local feature and print out the secret content.
Note: Writing the secret to a file is obviously the opposite of what one would actually do with the build-secret flag, but it demonstrates that the secret can be read and used just like with regular Docker secrets.
In our CI pipeline, we use build secrets to inject secrets for our internal registries into our Dockerfile. However, the devcontainer CLI currently doesn't support using those secrets from within a feature. This limitation exists because the synthesized Dockerfile for building features requires additional parameters like --mount=type=secret,id=aws.
I created a PR that addresses this issue and allows providing secrets to features in the same way as with a regular docker buildx command. Here's an example of how it works:
In the feature
install.sh:On the terminal:
devcontainer build --workspace-folder test-build-secrets --build-secret id=compose_file,src=./my_cred.txt --image-name test-build-secrets-image --no-cache docker run --rm --entrypoint="cat" test-build-secrets-image /secret_file.txtThis will build the devcontainer with the local feature and print out the secret content.
Note: Writing the secret to a file is obviously the opposite of what one would actually do with the build-secret flag, but it demonstrates that the secret can be read and used just like with regular Docker secrets.