search

nginxinc / docker-nginx-controller

Docker support for NGINX Controller Agent in Containers
Apache License 2.0
29 stars 26 forks source link

Secure docker layers from key disclosure #61

Closed aknot242 closed 3 years ago

aknot242 commented 3 years ago

using secrets and secure mounts will prevent certs + keys from being present in intermediate container layers.

1996sajal commented 3 years ago

@aknot242 really appreciate this change. Will merge asap after I play around a bit with this. 👍🏻

1996sajal commented 3 years ago

@aknot242 I was able to verify but had to make some small changes which you include in the MR. Add this comment at the start of the dockerfiles. # syntax=docker/dockerfile:experimental

External implementation features This feature is only available when using the BuildKit backend.

Docker build supports experimental features like cache mounts, build secrets and ssh forwarding that are enabled by using an external implementation of the builder with a syntax directive. To learn about these features, refer to the documentation in BuildKit repository.

Follow this thread:- https://stackoverflow.com/a/55153182

aknot242 commented 3 years ago

@1996sajal you are welcome to change it, but that StackOverflow thread is almost 3 years old. syntax=docker/dockerfile:experimental shouldn't be needed anymore. What version of Docker are you using? FWIW, none of the other teams are seeing this with their version of docker when making this change (NIC, NAP, etc).

1996sajal commented 3 years ago

@aknot242 can you have a mention in the readme that if docker version is less than 20 so have this at the top of docker file. syntax=docker/dockerfile:experimenta Thanks.

aknot242 commented 3 years ago

@1996sajal Done.

1996sajal commented 3 years ago

Passed smoke tests and validations I ran merging this now. Thanks @aknot242 for this one.