在Dockerfile中使用github秘密不适用于github动作
我有一个github动作，可以从与github动作的同一仓库中的dockerfile构建图像。
在Dockerfile中，我使用敏感数据，因此我选择使用GitHub秘密。
这是我的Dockerfile：
From python:3.9.5
ARG NEXUS_USER
ARG NEXUS_PASS
RUN pip install --upgrade pip
RUN pip config set global.extra-index-url https://${NEXUS_USER}:${NEXUS_PASS}@<my nexus endpoint>
RUN pip config set global.trusted-host <my nexus endpoint>
COPY ./src/python /python-scripts
ENTRYPOINT [ "python", "/python-scripts/pipe.py" ]
构建图像
jobs:
docker:
runs-on: self-hosted
.
.
.
.
.
- name: build
run: |
docker build -t ${GITHUB_REPO} .
使用此Dockerfile：操作在调用Dockerfile的GitHub Secret时 失败。做什么的正确方法是什么？如您所见，我尝试在Dockerfile中添加ARG，但这也没有用。
I have a Github Action to build image from a Dockerfile located in the same repo with the Github Action.
In the Dockerfile I use sensitive data so I chose to use Github Secrets.
Here is my Dockerfile:
From python:3.9.5
ARG NEXUS_USER
ARG NEXUS_PASS
RUN pip install --upgrade pip
RUN pip config set global.extra-index-url https://${NEXUS_USER}:${NEXUS_PASS}@<my nexus endpoint>
RUN pip config set global.trusted-host <my nexus endpoint>
COPY ./src/python /python-scripts
ENTRYPOINT [ "python", "/python-scripts/pipe.py" ]
Actions builds an image using this Dockerfile:
jobs:
docker:
runs-on: self-hosted
.
.
.
.
.
- name: build
run: |
docker build -t ${GITHUB_REPO} .
Action fails when calling the Github secrets from Dockerfile. What is the proper way to do that? As you can see I tried to add ARG in Dockerfile but that didn't work as well.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
仅适用于将来会访问此页面的人。
docker
- build-arg不建议用于秘密。秘密将保留在图像中，谁下载图像并进行检查，都会看到您的密码。
Docker对秘密及其
有自己的论点 - 秘密just for people that will visit this page in the future.
The Docker
--build-argargument is not recommended for secrets.Secrets will remain in the image and whoever downloads the image and inspect it, will see your password.
Docker has its own argument for secrets and its
--secret尚不清楚您从Dockerfile调用秘密的位置，顺便说一句，您可以使用build-arg标志将凭据传递给构建命令，例如：
Is not clear where you are calling secrets from the Dockerfile, BTW you could pass the credentials to the build command using the build-arg flag, like: