devcontainers / devcontainers/cli

New feature: Add --build-secret argument

Abierto
#1,077 2 comentarios 7 reacciones 0 asignados Ver en GitHub
feature-request
Lenguaje dominante
TypeScript
Estrellas
3k
Forks
457
Merge medio
13 h 17 min
PR fusionados (30 d)
6

Descripción

In our CI pipeline, we use [build secrets](https://docs.docker.com/build/building/secrets/) to inject secrets for our internal registries into our Dockerfile. However, the devcontainer CLI currently doesn't support using those secrets from within a feature. This limitation exists because the synthesized Dockerfile for building features requires additional parameters like --mount=type=secret,id=aws.

I created a PR that addresses this issue and allows providing secrets to features in the same way as with a regular docker buildx command. Here's an example of how it works:

In the feature `install.sh`:
```sh
#!/bin/bash
set -e
if [ -f /run/secrets/compose_file ]; then
echo "Contents of secret file:"
cat /run/secrets/compose_file
echo "Writing secret file contents to /secret_file.txt"
cat /run/secrets/compose_file > /secret_file.txt
else
echo "Secret file not found!"
exit 1
fi
```

On the terminal:
```sh
devcontainer build --workspace-folder test-build-secrets --build-secret id=compose_file,src=./my_cred.txt --image-name test-build-secrets-image --no-cache
docker run --rm --entrypoint="cat" test-build-secrets-image /secret_file.txt
```
This will build the devcontainer with the local feature and print out the secret content.

**Note: Writing the secret to a file is obviously the opposite of what one would actually do with the build-secret flag, but it demonstrates that the secret can be read and used just like with regular Docker secrets.**

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.