# How can i pass secrets as build\_args to plugins/docker \[drone 0.8\]? **URL:** \ **Category:** Drone Support\ **Created:** [October 7, 2017, 3:03pm UTC](https://drone.discourse.group/t/how-can-i-pass-secrets-as-build-args-to-plugins-docker-drone-0-8/10518 "2017-10-07T15:03:03Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![rafalp](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/rafalp/32/3607_2.png) [@rafalp](https://drone.discourse.group/u/rafalp)\ **Post date:** [October 7, 2017, 3:03pm UTC](https://drone.discourse.group/t/how-can-i-pass-secrets-as-build-args-to-plugins-docker-drone-0-8/10518/1 "2017-10-07T15:03:03Z")
Hi, I need to pass ssh key to clone private Bitbucket repo as npm module. I added a secret to [drone.io](http://drone.io) using: ```bash drone secret add --image=* --repository octocat --value SSH_KEY ``` Dockerfile looks like this: ```auto FROM node:latest ARG SSH_KEY RUN mkdir /root/.ssh && \ echo $SSH_KEY | cut -d "\"" -f 2 > /root/.ssh/id_rsa && \ chmod 0600 /root/.ssh/id_rsa && \ eval `ssh-agent -s` && \ ssh-add /root/.ssh/id_rsa && \ echo "StrictHostKeyChecking no" >> /etc/ssh/ssh_config RUN mkdir /app WORKDIR /app COPY . /app RUN npm install EXPOSE 3001 CMD ["npm", "start"] ``` and drone.yml ```auto pipeline: run-tests: image: node:6 commands: - export PATH=$PATH:./node_modules/.bin - mkdir -p ~/.ssh - touch ~/.ssh/known_hosts - ssh-keyscan bitbucket.org >> ~/.ssh/known_hosts - eval $(ssh-agent) - echo "StrictHostKeyChecking no" >> /etc/ssh/ssh_config - echo $SSH_KEY | base64 -d > ~/.ssh/id_rsa - chmod 600 ~/.ssh/id_rsa - npm install - npm install --only=dev - npm test secrets: [ssh_key] publish: image: plugins/docker secrets: [docker_username, docker_password, ssh_key] repo: my-app build_args: - SSH_KEY=${SSH_KEY} ``` Secrets are injected into _run-test_ step, but i have no idea how can I pass them to _publish_ step. ---
**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\ **Post date:** [October 7, 2017, 3:13pm UTC](https://drone.discourse.group/t/how-can-i-pass-secrets-as-build-args-to-plugins-docker-drone-0-8/10518/2 "2017-10-07T15:13:21Z")
Drone injects secrets as environment variables. There is a parameter you can use to source build arguments from environment variables. You can therefore do this: ```auto kind: pipeline type: docker name: default steps: - name: publish image: plugins/docker environment: ssh_key: from_secret: ssh_key settings: repo: xxxx tags: xxxx build_args_from_env: [ssh_key] ``` > [@rafalp](#): > > SSH\_KEY=${SSH\_KEY} This does not work because secrets cannot be interpolated. ---
**Author:** ![rafalp](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/rafalp/32/3607_2.png) [@rafalp](https://drone.discourse.group/u/rafalp)\ **Post date:** [October 9, 2017, 1:32pm UTC](https://drone.discourse.group/t/how-can-i-pass-secrets-as-build-args-to-plugins-docker-drone-0-8/10518/3 "2017-10-09T13:32:00Z")
> [@bradrydzewski](#): > > build\_args\_from\_env Thanks for quick answer. Works like a charm. However [http://plugins.drone.io/drone-plugins/drone-docker/](http://plugins.drone.io/drone-plugins/drone-docker/) doesn’t mention about _build\_args\_from\_env_. I know it’s a fresh addition. I can update docs if you tell me where I can find them. ---
**Author:** ![peetasan](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/peetasan/32/3664_2.png) [@peetasan](https://drone.discourse.group/u/peetasan)\ **Post date:** [October 20, 2017, 4:08pm UTC](https://drone.discourse.group/t/how-can-i-pass-secrets-as-build-args-to-plugins-docker-drone-0-8/10518/4 "2017-10-20T16:08:06Z")
This looks great and seems to be working. Couple questions though - If I try to execute my build locally with drone exec then I can’t use the ssh key, because only the part until the first space gets into the id\_rsa file (-----BEGIN) - on our drone server though the whole key is in the file. Is this a know issue with the cli? - with the build running on the server the logs include the whole key as part of the docker build command’s --build-arg parameter value. I saw there is a conceal feature, but not sure how to make that work. Any thoughts on this? Thank you! ---
**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\ **Post date:** [October 20, 2017, 4:29pm UTC](https://drone.discourse.group/t/how-can-i-pass-secrets-as-build-args-to-plugins-docker-drone-0-8/10518/5 "2017-10-20T16:29:11Z")
> [@peetasan](#): > > I saw there is a conceal feature, but not sure how to make that work The conceal feature does not work for multi-line secrets. I presume the key is to clone private dependencies? You could always clone your dependencies outside of your Dockerfile and include using the ADD directive. Alternatively you can always fork the Docker plugin and customize it. Plugins are intentionally easy to fork, customize and then substitute in your yaml file. ```diff steps: - name: publish - image: plugins/docker + image: peetasan/my-drone-docker-plugin environment: ssh_key: from_secret: ssh_key settings: repo: xxxx tags: xxxx build_args_from_env: [ssh_key] ``` ---
**Author:** ![omerxx](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/omerxx/32/3956_2.png) [@omerxx](https://drone.discourse.group/u/omerxx)\ **Post date:** [May 20, 2018, 9:48pm UTC](https://drone.discourse.group/t/how-can-i-pass-secrets-as-build-args-to-plugins-docker-drone-0-8/10518/6 "2018-05-20T21:48:48Z")
This is VERY helpful! How come it’s not documented? I’ve built a plugin dedicated to the injection of secrets as environment variables to services