CODEWITHSUNDEEP
linuxgitauthenticationdockeralpine-linux
YAC
YAC

Reputation: 435

How to bake credential into docker image for git?

This is actually a question following from my previous one.

I am trying to use docker to host a personal note-taking web service and want to backup data generated by the service (my notes). Currently I plan to use git to commit, pull, and push to a repository for my purpose.

To do git pull and push, my docker image needs to host my credentials. What is the easiest yet safe way to achieve this?

What I have done so far:

However, I cannot make git-credential-libsecret functional so far. Here are a couple of problems that I encountered:

In conclusion, I would like to know:

  1. Am I on a right direction (using git credential helper) to achieve my goal?
  2. If so, how can I resolve the X11 problem?
  3. Are there any other quick and clean methods to backup data in docker with version control?

Upvotes: 7

Views: 14678

Answers (4)

Chetan B B
Chetan B B

Reputation: 31

I had a requirement once, where I needed to run the git clone cmd inside the Docker image, I was using a private bitbucket. To authorize we needed to pass git credentials, the only problem was we were not able to hardcode them, So what I did was,

  1. setup git inside the docker file

# Install git and other dependencies
RUN apt-get update && \
    apt-get install -y git && \
    apt-get clean

  1. The next step is to configure git credentials. for this you can do 2 ways, first, Inside the Dockerfile you could run this command 'RUN git config --global credential.helper "!f() {{ echo \\"username={BB_USER_NAME}\\"; echo \\"password={BB_PASS_WORD}\\"; }};

    second, since in my case the BB_USER_NAME and BB_PASS_WORD are stored as secrets they won't be available when building the image(i.e. while docker builds... cmd). So the solution to this is, whenever a flask app (our server is a flask app), before the server runs you can run this cmd, and also BB_USER_NAME and BB_PASS_WORD are stored as secrets will be available when the server is started.

In app.py file


"""Flask APP"""

from flask import Flask
from utils.util import setup_git_credentials

if __name__ == "__main__":
    setup()
    APP = Flask(__name__)
    # Setup git credentials 
    APP.before_first_request(setup_git_credentials) #as the name of the method implies this will run the method `setup_git_credentials` before server starts.
    APP.run(host="0.0.0.0",port=5020,debug=True)

utils.util.py

def setup_git_credentials():
    BB_USER_NAME = os.environ.get("BB_USER_NAME",None)
    BB_PASS_WORD = os.environ.get("BB_PASS_WORD",None)
    logger.info("Running Git configuration")
    if BB_USER_NAME and BB_PASS_WORD:
        cmd = f'git config --global credential.helper "!f() {{ echo \\"username={BB_USER_NAME}\\"; echo \\"password={BB_PASS_WORD}\\"; }}; f"'
        subprocess.run(cmd, shell=True)
        logger.info("Completed Git configuration")

This is how I resolved it! Cheers

Upvotes: 0

patrick
patrick

Reputation: 9742

I solved this problem by doing:

# syntax=docker/dockerfile:1

FROM alpine:latest
RUN apk update
RUN apk add git
RUN --mount=type=secret,id=git_credential_store \
  git clone "https://me:$(cat /run/secrets/git_credential_store | sed 's/.*\/\/\(.*\):.*/\1/')@github.com/me/app-repo.git"

and supply the secret like this:

docker build --secret id=git_credential_store,src=/path/to/.git-credential-store -t my-amazing-image

Upvotes: 0

max630
max630

Reputation: 9248

If your git provider supports ssh with public keys, I think the easiest way would be to switch to them. You would also not have to copy around your password.

You need to:

Upvotes: 3

VonC
VonC

Reputation: 1327384

It depends on where you are running git-credential-libsecret: you need to have it installed in your image/container, not on the host.

Note that another option would be to use a volume (see my answer to your previous question), in which case, git could be installed only on the host.

But here, you would use git directly in your image, which means, as in this Dockerfile, you need to have in your Dockerfile:

RUN apt-get update -y &&
apt-get install --no-install-recommends -y libsecret-1-0 git

https://github.com/electron-userland/electron-builder/blob/master/docker/base/Dockerfile

Upvotes: 1

Related Questions