search

buildkite-plugins / docker-compose-buildkite-plugin

🐳⚡️ Run build scripts, and build + push images, w/ Docker Compose
MIT License
172 stars 139 forks source link

Security - Support docker buildkit secrets #356

Closed TSMMark closed 1 year ago

TSMMark commented 1 year ago

I'm creating a new issue from the convo here, for better organization https://github.com/buildkite-plugins/docker-compose-buildkite-plugin/pull/334#issuecomment-1289734691

I do think using buildkit secrets would be a big win for the security of containers running on buildkite. AFAICT currently the quickest way to provide secrets to a docker build using this plugin is with build args + env vars — however, those approaches expose the secrets in plain text in the built docker image and is considered bad practice for obvious security reasons

e.g.

https://pythonspeed.com/articles/docker-build-secrets/

Docker 20.10 adds the additional ability to load secrets from environment variables, not just files. For example, if you have an environment variable MYSECRET, you can access it like this:

$ export MYSECRET=theverysecretpassword
$ export DOCKER_BUILDKIT=1
$ docker build --secret id=mysecret,env=MYSECRET .