CODEWITHSUNDEEP
dockerdockerfiledocker-buildkit
Mike
Mike

Reputation: 1310

Docker RUN Instruction with a Mounted Secret in Exec Form

What is the proper syntax for a RUN instruction in a Dockerfile, that requires mounting a secret, in exec form?

In other words, if a Dockerfile that looks something like:

FROM node:fermium-alpine

# . . .

RUN --mount=type=secret,id=npmrc yarn build:production

# . . .

how could the RUN instruction above be converted from shell form to exec form? There doesn't seem to be an example in the official docs here.

Upvotes: 1

Views: 976

Answers (1)

Mike
Mike

Reputation: 1310

FROM node:fermium-alpine


WORKDIR /usr/src/app

# . . .

RUN --mount=type=secret,id=npmrc,dst=/usr/src/app/.npmrc ["/usr/local/bin/yarn", \
                                                          "build:production"]

# . . .

Note:

  • The --mount flag is kept outside of the JSON array to its right
  • The dst=. . . has been added to the --mount flag above to ensure that .npmrc is not only saved as a dotfile, but that it is saved in the WORKDIR so that yarn can use it during the build
  • RUN instructions with the --mount= . . .,dst=. . . in exec form can get lengthy; use \ to split long lines in a Dockerfile (taken from Dockerfile best practices here)
  • Just to be on the safe side, since shell form is not being used here, the yarn executable was replaced with the absolute path /usr/local/bin/yarn for the node:fermium-alpine image

Upvotes: 3

Related Questions