CODEWITHSUNDEEP
dockerdocker-composedockerfilessh-keys
smart
smart

Reputation: 2065

Docker: share private key via arguments

I want to share my github private key into my docker container.

I'm thinking about sharing it via docker-compose.yml via ARGs.

Is it possible to share private key using ARG as described here? Pass a variable to a Dockerfile from a docker-compose.yml file

# docker-compose.yml file

version: '2'

services:
  my_service:
    build:
      context: .
      dockerfile: ./docker/Dockerfile
      args:
        - PRIVATE_KEY=MULTI-LINE PLAIN TEXT RSA PRIVATE KEY

and then I expect to use it in my Dockerfile as:

ARG PRIVATE_KEY
RUN echo $PRIVATE_KEY >> ~/.ssh/id_rsa 
RUN pip install git+ssh://[email protected]/...

Is it possible via ARGs?

Upvotes: 3

Views: 4823

Answers (2)

Matt
Matt

Reputation: 74899

Although the ARG itself will not persist in the built image, when you reference the ARG variable somewhere in the Dockerfile, that will be in the history:

FROM busybox
ARG SECRET
RUN set -uex; \
    echo "$SECRET" > /root/.ssh/id_rsa; \
    do_deploy_work; \
    rm /root/.ssh/id_rsa

As VonC notes there's now a swarm feature to store and manage secrets but that doesn't (yet) solve the build time problem.

Builds

Coming in Docker ~ 1.14 (or whatever the equivalent new release name is) should be the --build-secret flag (also #28079) that lets you mount a secret file during a build.

In the mean time, one of the solutions is to run a network service somewhere that you can use a client to pull secrets from during the build. Then if the build puts the secret in a file, like ~/.ssh/id_rsa, the file must be deleted before the RUN step that created it completes.

The simplest solution I've seen is serving a file with nc:

docker network create build
docker run --name=secret \
   --net=build \
   --detach \
   -v ~/.ssh/id_rsa:/id_rsa \
   busybox \
   sh -c 'nc -lp 8000 < /id_rsa'
docker build --network=build .

Then collect the secret, store it, use it and remove it in the Dockerfile RUN step. 

FROM busybox
RUN set -uex; \
    nc secret 8000 > /id_rsa; \
    cat /id_rsa; \
    rm /id_rsa

Projects

There's a number of utilities that have this same premise, but in various levels of complexity/features. Some are generic solutions like Hashicorps Vault.

Upvotes: 2

VonC
VonC

Reputation: 1329692

If you can use the latest docker 1.13 (or 17.03 ce), you could then use the docker swarm secret: see "Managing Secrets In Docker Swarm Clusters"

That allows you to associate a secret to a container you are launching:

docker service create --name test \
    --secret my_secret \
    --restart-condition none \
    alpine cat /run/secrets/my_secret

If docker swarm is not an option in your case, you can try and setup a docker credential helper.
See "Getting rid of Docker plain text credentials". But that might not apply to a private ssh key.

You can check other relevant options in "Secrets and LIE-abilities: The State of Modern Secret Management (2017)", using standalone secret manager like Hashicorp Vault.

Upvotes: 2

Related Questions