python - Docker - 使用 DOCKER_BUILDKIT 在构建期间传递 token secret

Question

我有一个使用 twine 发布的 pip 可安装包Azure DevOps 工件。

在我的构建镜像中，我需要下载该包并使用 pip 安装它。所以我需要针对 azure 工件进行身份验证以获取它。所以我正在使用artifacts-keyring这样做

pip 可安装 URL 如下所示:

https://<token>@pkgs.dev.azure.com/<org>/<project>/_packaging/<feed>/pypi/simple/ --no-cache-dir <package-name>

实际上我正在使用docker image build --build-arg ...方法来成功。我的 Dockerfile 是:

FROM mcr.microsoft.com/azure-functions/python:3.0-python3.7 as intermediate
RUN apt-get update && apt-get install -y git && \
    wget https://packages.microsoft.com/config/ubuntu/20.10/packages-microsoft-prod.deb -O packages-microsoft-prod.deb && \
    dpkg -i packages-microsoft-prod.deb && \
    apt-get update; \
    apt-get install -y apt-transport-https && \
    apt-get update && \
    apt-get install -y dotnet-sdk-5.0
# dotnet core is required from keyring artifacts-keyring pip package below
# that package is used to authenticate against azure devops.

ARG ARTIFACTS_KEYRING_NONINTERACTIVE_MODE
ENV ARTIFACTS_KEYRING_NONINTERACTIVE_MODE=true

# I created a variable to pass the Azure PAT Token
ARG AZ_DEVOPS_TOKEN
ENV AZ_DEVOPS_TOKEN=$AZ_DEVOPS_TOKEN

RUN \
    pip install --upgrade pip && \
    # INSTALL artifacts-keyring
    pip install pyyaml numpy lxml artifacts-keyring && \
    # INSTALL THE PACKAGE passing the token on the url
    pip install -i https://<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="c4e0859e9b8081928b94979b908b8f818a84b4afa3b7eaa0a1b2eaa5beb1b6a1eaa7aba9" rel="noreferrer noopener nofollow">[email protected]</a>/<org>/<project>/_packaging/<feed>/pypi/simple/ --no-cache-dir <package-name>

它有效，我设法通过 pip 在我构建的图像中安装我的私有(private)包。

问题是我听说在构建期间传递 secret 的更正确方法是 Docker BuildKit 。所以我以这种方式稍微重新定义了我的 Dockerfile:

#PREREQUIREMENTS APT GET PACKAGES INSTALLED
...

ARG ARTIFACTS_KEYRING_NONINTERACTIVE_MODE
ENV ARTIFACTS_KEYRING_NONINTERACTIVE_MODE=true

# Not sure If i need to define token env variable
ARG AZ_DEVOPS_TOKEN
ENV AZ_DEVOPS_TOKEN=$AZ_DEVOPS_TOKEN

# I mounted the secets on the destination /run/secrets/azdevopstoken in my container
RUN --mount=type=secret,id=azdevopstoken,dst=/run/secrets/azdevopstoken

RUN \
    pip install --upgrade pip && \
    # INSTALL artifacts-keyring
    pip install pyyaml numpy lxml artifacts-keyring && \

    # HOW CAN I PASS THE SECRET HERE AT THE URL SINCE IT IS SUPPOSED TO BE MOUNTED? 
    # $AZ_DEVOPS_TOKEN IS NOT VALID HERE ...
    pip install -i https://<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="a98de8f3f6edecffe6f9faf6fde6e2ece7e9d9c2ceda87cdccdf87c8d3dcdbcc87cac6c4" rel="noreferrer noopener nofollow">[email protected]</a>/<org>/<project>/_packaging/<feed>/pypi/simple/ --no-cache-dir <package-name>

问题是我的 secret 没有被安装，即使我设法做到这一 pip ，我也不知道如何在执行 pip install 时将其与 URL 关联:

pip install -i https://<SECRETMOUNTED>@pkgs.dev.azure.com/<org>/<project>/_packaging/<feed>/pypi/simple/ --no-cache-dir <package-name>

Answer 1

您的 RUN --mount 指令缺少命令。

装载您的 secret 的文件仅在该构建步骤期间可用。您需要在该指令的末尾添加一个命令才能使用已安装的 secret 。您可以组合 2 个 RUN 指令并添加 command substitution ($(cat "filename")) 以获得所需的结果。

RUN --mount=type=secret,id=azdevopstoken,dst=/run/secrets/azdevopstoken \
    pip install --upgrade pip && \
    # INSTALL artifacts-keyring
    pip install pyyaml numpy lxml artifacts-keyring && \

    pip install -i https://"$(</run/secrets/azdevopstoken)"@pkgs.dev.azure.com/<org>/<project>/_packaging/<feed>/pypi/simple/ --no-cache-dir <package-name>