secrets: allow providing secrets with env

[tonistiigi]

Support --secret id=foo,env=MY_ENV as an alternative for storing a secret value to a file. --secret id=GIT_AUTH_TOKEN will load env if it exists and the file does not.

Signed-off-by: Tonis Tiigi [email protected]

[chris-crone]

LGTM

[hinshun]

Is there any difference between secret env and setting env on the llb.State?

[tonistiigi]

@hinshun This doesn't set any env in llb.State, just allows reading the secret value stored in env on client side. Eg. if you already have GITHUB_TOKEN defined locally you don't need to write it into a file to run --secret id=token,src=/tmp/tokenfile but can just do --secret id=token,env=GITHUB_TOKEN or --secret id=GITHUB_TOKEN.

[avdhoot]

Dockerfile

# syntax = docker/dockerfile:labs
FROM ubuntu:18.04
RUN --mount=type=secret,id=PYPI_KEY echo $PYPI_KEY && echo hi

Command

DOCKER_BUILDKIT=1 docker build --no-cache --progress plain --secret id=PYPI_KEY,env=PYPI_KEY -f Dockerfile_build ..

Output

#7 [2/2] RUN --mount=type=secret,id=PYPI_KEY echo $PYPI_KEY && echo hi
#7 sha256:2c5120eaabd9451b42da9691458ecbe15e84bd92165c2f94d04cab6342bf4ea4
#7 0.094 
#7 0.094 hi
#7 DONE 0.1s

Expected value of PYPI_KEY will be available at build. Is right assumption? @tonistiigi

[tonistiigi]

No, you would need

RUN --mount=type=secret,id=PYPI_KEY export PYPI_KEY=$(cat /run/secrets/PYPI_KEY) && echo $PYPI_KEY && echo hi

Second command should work as expected

[shaaga]

RUN --mount=type=secret,id=PYPI_KEY cat /run/secrets/PYPI_KEY gives No such file or directory error

Docker build command has
--secret id=PYPI_KEY,env=RHS_USERNAME

There is an env variable with name RHS_USERNAME

However if I place the env variable value in a file named "~/secrets.txt" and replace env=RHS_USERNAME with src=/home//secrets.txt, it works just fine.

Seems when secrets are read from env variables, values are not mounted in /run/secrets/secret-id file??

[shaaga]

@tonistiigi , created this issue for the above comment, can you please have a look: #2302

[NatoBoram]

RUN --mount=type=secret,id=PYPI_KEY PYPI_KEY=$(cat /run/secrets/PYPI_KEY) && echo $PYPI_KEY && echo hi

Note: You don't need to export. You can define it inline:

RUN --mount=type=secret,id=BUILD_BASE BUILD_BASE="$(cat /run/secrets/BUILD_BASE)" pnpm run build