New feature: Add --build-secret argument
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- docker, shell, typescript
- Domain
- build-system, cli, devops
Research direction
Start with the devcontainer build command shown in the issue and trace how feature builds synthesize their Dockerfile. Reproduce the example using --build-secret and the local feature's install.sh; done means the feature can read /run/secrets/compose_file and the resulting image contains the expected secret content.
Written by the indexing model from the issue text.
Description
In our CI pipeline, we use build secrets to inject secrets for our internal registries into our Dockerfile. However, the devcontainer CLI currently doesn't support using those secrets from within a feature. This limitation exists because the synthesized Dockerfile for building features requires additional parameters like --mount=type=secret,id=aws.
I created a PR that addresses this issue and allows providing secrets to features in the same way as with a regular docker buildx command. Here's an example of how it works:
In the feature install.sh:
#!/bin/bash
set -e
if [ -f /run/secrets/compose_file ]; then
echo "Contents of secret file:"
cat /run/secrets/compose_file
echo "Writing secret file contents to /secret_file.txt"
cat /run/secrets/compose_file > /secret_file.txt
else
echo "Secret file not found!"
exit 1
fi
On the terminal:
devcontainer build --workspace-folder test-build-secrets --build-secret id=compose_file,src=./my_cred.txt --image-name test-build-secrets-image --no-cache
docker run --rm --entrypoint="cat" test-build-secrets-image /secret_file.txt
This will build the devcontainer with the local feature and print out the secret content.
Note: Writing the secret to a file is obviously the opposite of what one would actually do with the build-secret flag, but it demonstrates that the secret can be read and used just like with regular Docker secrets.
- Dominant language
- TypeScript
- Stars
- 3k
- Forks
- 461
- Avg merge
- 18m
- Merged PRs (30d)
- 5
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from devcontainers/cli
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
devcontainers/cli#1203 ·
-
Difficulty 1/5 1-3 hours Newbie friendliness 68/100
devcontainers/cli#1178 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
devcontainers/cli#1308 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 78/100
devcontainers/cli#1307 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
devcontainers/cli#1305 ·
All issues in devcontainers/cli
Similar issues
-
clawsweeper:linked-pr-open clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:message-loss issue-rating: 🦞 diamond lobster maturity:stable P2
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#616 ·
-
ZCode 3.14.3 に対応する Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
supermomonga/zcode-acp#24 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
growthbook/growthbook#7100 ·
-
triage
Difficulty 1/5 1-3 hours Newbie friendliness 88/100