Using secrets in build-args in plugins/docker

Drone Support
1

This doesn’t seem to work? :slight_smile:

      build_args:
        - GEMFURY_NPMRC=$GEMFURY_NPMRC
      GEMFURY_NPMRC:
        from_secret: GEMFURY_NPMRC
2

This is expected. GEMFURY_NPMRC=$GEMFURY_NPMRC is bash syntax and build_args is a Go []string. A Go []string will not expand bash syntax.

3

Hmm, I have this code working in Drone 0.8

docker build --build-arg GEMFURY_NPMRC=$GEMFURY_NPMRC

And it doesn’t seem to work with just using a commands:, since it does a lot on startup.

Would it make sense to add a custom “commands:” where you can execute any docker command. In this example it feels like a thin abstraction on top of docker, that will always be one step behind.

4

Hmm, I have this code working in Drone 0.8
docker build --build-arg GEMFURY_NPMRC=$GEMFURY_NPMRC

the commands section is converted to a bash file, which means it is able to process syntax. The build_args section is Go string and is not able to process bash syntax. It probably makes a bit more sense when you understand the underlying implementation, but this is the expected behavior.

Would it make sense to add a custom “commands:” where you can execute any docker command. In this example it feels like a thin abstraction on top of docker, that will always be one step behind.

The docker plugin runs in privileged mode, and is restricted to docker build and docker tag commands. We cannot allow execution of arbitrary docker run commands for security reasons.

5

It would be a valid usecase to use secrets in buildargs, even when buildkit introduces mounted secrets :slight_smile:

6

It would be a valid usecase to use secrets in buildargs

Drone supports this. See my comment in this thread: Does the "verify" API endpoint work?

1 Like
7

Nice :+1: it could be an idea to have something that generate documentation from the sourcecode so that you don’t have too :smile: