devcontainers / devcontainers/cli

New feature: Add --build-secret argument

未关闭
#1,077 2 条评论 7 个 reaction 已指派 0 人 在 GitHub 查看
feature-request
主要语言
TypeScript
星标
3k
派生
457
平均合并
13 小时 17 分钟
30 天内合并 PR
6

描述

In our CI pipeline, we use [build secrets](https://docs.docker.com/build/building/secrets/) to inject secrets for our internal registries into our Dockerfile. However, the devcontainer CLI currently doesn't support using those secrets from within a feature. This limitation exists because the synthesized Dockerfile for building features requires additional parameters like --mount=type=secret,id=aws.

I created a PR that addresses this issue and allows providing secrets to features in the same way as with a regular docker buildx command. Here's an example of how it works:

In the feature `install.sh`:
```sh
#!/bin/bash
set -e
if [ -f /run/secrets/compose_file ]; then
echo "Contents of secret file:"
cat /run/secrets/compose_file
echo "Writing secret file contents to /secret_file.txt"
cat /run/secrets/compose_file > /secret_file.txt
else
echo "Secret file not found!"
exit 1
fi
```

On the terminal:
```sh
devcontainer build --workspace-folder test-build-secrets --build-secret id=compose_file,src=./my_cred.txt --image-name test-build-secrets-image --no-cache
docker run --rm --entrypoint="cat" test-build-secrets-image /secret_file.txt
```
This will build the devcontainer with the local feature and print out the secret content.

**Note: Writing the secret to a file is obviously the opposite of what one would actually do with the build-secret flag, but it demonstrates that the secret can be read and used just like with regular Docker secrets.**

贡献指南

打开贡献指南

调研方向

从 issue 中显示的 devcontainer build 命令开始,跟踪 feature 构建如何合成其 Dockerfile。使用 --build-secret 和本地 feature 的 install.sh 重现该示例;当 feature 能够读取 /run/secrets/compose_file,且生成的镜像包含预期的 secret 内容时,即表示完成。

由索引模型根据 Issue 内容生成。

评估

技术栈
docker, shell, typescript
领域
build-system, cli, devops
Issue 类型
功能
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
25/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。