18

Is it possible to access machine environments inside dockerfile? I was thinking passing the SECRET as build ARG, like so:

docker-compose:

version: '3.5'
services:
  service:
    ...
    build:
      ...
      args:
        SECRET: ${SECRET}
    ...

dockerfile:

FROM image
ARG SECRET
RUN script-${SECRET}

Note: the container is build in kubernetes, I can not pass any arguments to the build command or perform any command at all.

Edit 1: It is okay to pass SECRET as ARG because this is not sensitive data. I'm using SECRETS to access micro service data, and I can only store data using secrets. Think of this as machine environment.

Edit 2: This was not a problem with docker but with the infrastructure that I was working with which does not allow any arguments to be passed to the docker build.

4 Answers 4

34

The secrets should be used during run time and provided by execution environment.

Also everything that is executing during a container build is written down as layers and available later to anyone who is able to get access to an image. That's why it's hard to consume secrets during the build in a secure way.

In order to address this, Docker recently introduced a special option --secret. To make it work, you will need the following:

  1. Set environment variable DOCKER_BUILDKIT=1

  2. Use the --secret argument to docker build command

    DOCKER_BUILDKIT=1 docker build --secret id=mysecret,src=mysecret.txt
    
  3. Add a syntax comment to the very top of your Docker file

    # syntax = docker/dockerfile:1.0-experimental
    
  4. Use the --mount argument to mount the secret for every RUN directive that needs it

    RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret
    

Please note that this needs Docker version 18.09 or later.

3
  • 2
    You need to set the environment variable DOCKER_BUILDKIT=1 for this to work.
    – Ben T
    Apr 20, 2020 at 7:51
  • Link to the docs changed. See docker buildx build for more info
    – RiverHeart
    Mar 31, 2023 at 14:04
  • 1
    Note, this answer allows for secrets to be temporarily available in the build only. This may be what you want, it may not. @jonas' answer allows for them to be available during run only. Nov 16, 2023 at 15:19
2

ARG is a build time argument. You want to keep Secrets secret and not write them in the artifacts. Keep secrets in external environment variables or in external files.

docker run -e SECRET_NAME=SECRET_VALUE

and in docker-compose:

services:
  app-name:
    environment:
    - SECRET_NAME=YOUR_VALUE

or

services:
  app-name:
    env_file:
    - secret-values.env

Kubernetes

When you run exactly the same container image in Kubernetes, you mount the secret from a Secret object.

  containers:
  - name: app-name
    image: app-image-name
    env:
      - name: SECRET_NAME
        valueFrom:
          secretKeyRef:
            name: name-of-secret-object
            key: token
7
  • 2
    Why do you use a secret if it not is sensitive data ??? You can use environment variables otherwise.
    – Jonas
    Dec 2, 2019 at 17:26
  • 1
    I don't have access to environment variables :/ Dec 2, 2019 at 17:28
  • 2
    ARG is not a secret, so don't write that it is a secret. If you only have Secret in your Kubernetes, you can consume them as environment variables. But in a dockerfile there is no thing as a "secret", only arg or env.
    – Jonas
    Dec 2, 2019 at 17:56
  • 1
    Doing this is no longer best practice. Docker now features a system that properly disposes of secrets. Jan 13, 2021 at 22:15
  • 2
    Isn't this a bad practice as secrets will be available as environment variables later in the container? I read here why we shouldn't use env var for storing secrets:diogomonica.com/2017/03/27/…. Jan 13, 2022 at 10:53
1

Adding to Jonas' answer, one can even avoid explicitly setting up the environment variables values when passing them from the host OS to the docker container.

docker run -e SECRET_NAME

The above command seeds the SECRET_NAME environment variable - which should exist in the host OS - to the docker container.

0

Yes, to passing secret data as ARG if you need to access the secret during the container build; you have no (!?) alternative.

ARG values are only available for the duration of the build so you need to be able to trust the build process and that it is cleaned up appropriately at its conclusion; if a malicious actor were able to access the build process (or after the fact), it could access the secret data.

It's curious that you wish to use the secret as script-${SECRET} as I assumed the secret would be used to access an external service. Someone would be able to determine the script name from the resulting Docker image and this would expose your secret.

2
  • 1
    The environment used to deploy this docker can have SECRETS but not environment variables. So the intention is to consume SECRETS as if it was machine environments. This variables are consumed only during build. This may be a mistake but it seams to be the only alternative I can think of. Dec 2, 2019 at 19:26
  • You can use the ARGS values to set ENV values and send those values into the running container but it assumes nobody can get something into the running container to expose the values
    – Lee Meador
    May 2, 2022 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.