Add support for BuildKit secrets in imageBuild method#58
Add support for BuildKit secrets in imageBuild method#58RainyPixel wants to merge 1 commit intodocker:mainfrom
Conversation
This commit adds support for passing build-time secrets to the imageBuild method using Docker BuildKit's secret mounting feature. This allows users to securely pass sensitive data during image builds without exposing it in the final image layers or build history. Changes: - Add optional `secrets` parameter to imageBuild method options - Accepts Record<string, string> mapping secret IDs to their values - Secrets are passed to Docker API as JSON-encoded query parameter - Requires BuildKit (version: '2') to function - Add comprehensive JSDoc documentation for the secrets parameter - Explains usage with RUN --mount=type=secret syntax - Links to official Docker BuildKit secrets documentation - Add test case for BuildKit secrets functionality - Tests secret mounting during build - Verifies secrets are available during build but not in final image - Uses Alpine Linux base image with secret verification Security Benefits: - Secrets are NOT stored in image layers or history - Secrets are only available during build time at /run/secrets/<id> - No exposure in 'docker history' or image inspection - Follows Docker/Moby BuildKit API standards Backwards Compatibility: - Fully backwards compatible - secrets parameter is optional - Ignored when using classic builder (version: '1') - No breaking changes to existing API Related: BuildKit secrets support feature request
|
@ndeloof check plz |
| target: options?.target, | ||
| outputs: options?.outputs, | ||
| version: options?.version || '2', | ||
| secret: secretsParam, |
There was a problem hiding this comment.
weird this isn't documented in the API (https://docs.docker.com/reference/api/engine/version/v1.51/#tag/Image/operation/ImageBuild)
I also can't see this implemented in https://github.com/moby/moby/blob/master/daemon/server/router/build/build_routes.go#L38, did I miss something?
|
Yes, this is not natively supported by API calls, for example, here is a set of issues and pull request attempts in the Python library. And it is unclear whether it will be implemented or not, since the API does not have the ability to pass secrets, only the ability to call it by mounting, although developers need it. What do you think about this? |
|
I don't expect this to be implemented by the moby |
|
closing this PR as target endpoint parameter doesn't actually exists in Moby |
3 participants
RELATIVE TO issue #57