Uh oh!
There was an error while loading. Please reload this page.
Build --secret with buildkit - #1288
Conversation
tiborvass
commented
Aug 14, 2018
@vdemeester@cpuguy83 :) this is pretty dope. This is just wiring stuff together, the heavy lifting was done in buildkit repo. |
vdemeester
left a comment
There was a problem hiding this comment.
LGTM 🐯
Small lint failure to fix though 😉
cli/command/image/build_buildkit.go:1::warning: file is not gofmted with -s (gofmt)
cli/command/image/build_buildkit.go:1::warning: file is not goimported (goimports)
Codecov Report
@@ Coverage Diff @@## master #1288 +/- ##
==========================================
+ Coverage 54.03% 54.05% +0.01%
==========================================
Files 272 272 Lines 18072 18114 +42 ==========================================
+ Hits 9766 9792 +26 - Misses 7690 7706 +16
Partials 616 616 |
tiborvass
commented
Aug 14, 2018
@vdemeester fixed |
cpuguy83
left a comment
There was a problem hiding this comment.
LGTM
Weird that it leaves an empty file in the container image where you mount a secret. Is this an issue with the frontend or with buildkit?
| return secretsprovider.NewSecretProvider(store), nil | ||
| } | ||
| func parseSecret(value string) (*secretsprovider.FileSource, error) { |
There was a problem hiding this comment.
Maybe we can add some test for these two new functions?
thaJeztah
commented
Aug 15, 2018
Trying to get this to work, but I'm probably doing it wrong (running against Docker 18.06) printf"hello secret"> ./mysecret.txt
export DOCKER_BUILDKIT=1
docker build --no-cache --console=false --secret id=mysecret,src=$(pwd)/mysecret.txt -f - .<<EOF# syntax = tonistiigi/dockerfile:runmount20180618FROM busyboxRUN echo "hello world"RUN --mount=type=secret,id=mysecret echo "anything here"RUN --mount=type=secret,id=mysecret,dst=/foobar cat /foobarEOFWhatever I try to do with |
cpuguy83
commented
Aug 15, 2018
It doesn't work on 18.06, missing some daemon stuff. |
AkihiroSuda
commented
Aug 16, 2018
Is # syntax = still needed? |
@thaJeztah you're using the runmount flavored dockefile frontend, instead of secrets. Note that
Agreed it's weird, will debug it but shouldn't be a blocker for this PR. I added a couple of tests.
Yes, this is not part of the stable compiled-in default frontend. PTAL :) |
This patch implements `docker build --secret id=mysecret,src=/secret/file` for buildkit frontends that request the mysecret secret. It is currently implemented in the tonistiigi/dockerfile:secrets20180808 frontend via RUN --mount=type=secret,id=mysecret Signed-off-by: Tibor Vass <tibor@docker.com>
vendors github.com/docker/docker to a7ff19d69a90dfe152abd146221c8b9b46a0903d Signed-off-by: Tibor Vass <tibor@docker.com>
thaJeztah
commented
Aug 17, 2018
Tried this again, and looks good :) printf"hello secret"> ./mysecret.txt
export DOCKER_BUILDKIT=1
docker build --no-cache --progress=plain --secret id=mysecret,src=$(pwd)/mysecret.txt -f - .<<EOF# syntax = tonistiigi/dockerfile:secrets20180808FROM busyboxRUN --mount=type=secret,id=mysecret cat /run/secrets/mysecretRUN --mount=type=secret,id=mysecret,dst=/foobar cat /foobarEOF |
thaJeztah
commented
Aug 17, 2018
/cc @albers for bash completion 😅 |
tiborvass
commented
Aug 17, 2018
Big thanks to y'all for the review and to Tonis for the implementation! |
It is inaccurate to say that build args will not persist in the final image. They are visible with `docker history` and `docker inspect`. As soon as possible, we should upgrade to docker 18.09 to support `--secret` - a way to securely pass credentials into the build context. docker/cli#1288
haizaar
commented
Nov 4, 2018
@thaJeztah |
This patch implements
docker build --secret id=mysecret,src=/secret/filefor buildkit frontends that request the mysecret secret.
It is currently implemented in the tonistiigi/dockerfile:secrets20180808
frontend via RUN --mount=type=secret,id=mysecret
Signed-off-by: Tibor Vass tibor@docker.com
Also revendors buildkit and docker/docker
"<unknown>"in/inforesponse