load secret/environ using script and hide it from user

[nomagick]

Currently, the secret/environ is loaded using bare statements:

RUN --mount=type=secret,id=DOMAIN --mount=type=secret,id=REPO export DOMAIN="$(cat /run/secrets/DOMAIN)" export REPO="$(cat /run/secrets/REPO)"  &&   pip install --no-cache-dir -r requirements.txt

This is very ugly. Especially when there are multiple target environs, this statement is going on forever. This hurts the user experience because they will receive the log about the statement which has been changed from their original input.

Goals:

• [x] Load secret environs dynamically, so the length of the statement is irrelevant to the number of secret environs
• [x] Hide secret mounting statements from the user. So that they see the build log RUN statements the same as their input.
  • [x] This is harder because it might need to create our own dockerfile parser and modify the dockerfile internal AST parsing mechanism to inject hidden components. https://github.com/moby/buildkit/blob/357281b1779b10703410241c9f2bd8dd98dd9f2b/frontend/dockerfile/instructions/commands_runmount.go#L87-L102

[nomagick]

Fixed by https://github.com/jina-ai/hubble/pull/706

[nomagick]

The custom dockerfile is done by https://github.com/jina-ai/buildkit/pull/1

Rebased to the latest dockerfile release 1.4.3 branch: https://github.com/jina-ai/buildkit/tree/dockerfile/1.4.3-magic-shell

Published to https://hub.docker.com/r/jinahub/dockerfile