devcontainers / devcontainers/cli
New feature: Add --build-secret argument
- Langage dominant
- TypeScript
- Étoiles
- 3k
- Forks
- 457
- Merge moyen
- 13 h 17 min
- PR mergées (30 j)
- 6
Description
In our CI pipeline, we use [build secrets](https://docs.docker.com/build/building/secrets/) to inject secrets for our internal registries into our Dockerfile. However, the devcontainer CLI currently doesn't support using those secrets from within a feature. This limitation exists because the synthesized Dockerfile for building features requires additional parameters like --mount=type=secret,id=aws.
I created a PR that addresses this issue and allows providing secrets to features in the same way as with a regular docker buildx command. Here's an example of how it works:
In the feature `install.sh`:
```sh
#!/bin/bash
set -e
if [ -f /run/secrets/compose_file ]; then
echo "Contents of secret file:"
cat /run/secrets/compose_file
echo "Writing secret file contents to /secret_file.txt"
cat /run/secrets/compose_file > /secret_file.txt
else
echo "Secret file not found!"
exit 1
fi
```
On the terminal:
```sh
devcontainer build --workspace-folder test-build-secrets --build-secret id=compose_file,src=./my_cred.txt --image-name test-build-secrets-image --no-cache
docker run --rm --entrypoint="cat" test-build-secrets-image /secret_file.txt
```
This will build the devcontainer with the local feature and print out the secret content.
**Note: Writing the secret to a file is obviously the opposite of what one would actually do with the build-secret flag, but it demonstrates that the secret can be read and used just like with regular Docker secrets.**
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Commencez par la commande devcontainer build indiquée dans l’issue et suivez la manière dont les builds de features synthétisent leur Dockerfile. Reproduisez l’exemple avec --build-secret et l’install.sh de la feature locale ; c’est terminé lorsque la feature peut lire /run/secrets/compose_file et que l’image résultante contient le contenu attendu du secret.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- docker, shell, typescript
- Domaine
- build-system, cli, devops
- Type d'issue
- Fonctionnalité
- Difficulté
- 4/5
- Temps estimé
- 3-5 jours
- Activité
- À l'abandon
- Clarté
- Plutôt claire
- Accessibilité débutants
- 25/100