[Proposal] Inject temporary secret files into build

[bfirsh]

A common request is to be able to inject secret files into the build process and have them not end up in the built image.

For example:

• A user may be using RHEL and need to put their license key inside the container to install packages, but they don't want it to end up in the final image.
• A user may need to pass in their SSH agent/key to clone a Git repository, use a private Gem repo, use a private APT repo, etc.
• A user may need to pass in SSL certs to be able to install dependencies.

Possible solutions

• Some way of forwarding SSH agents into the build
• Build could allow volumes to be mounted
• Use some kind of secrets store which the build process could read from and turn into files. This could either need to be done in a single build step, or the files could be marked somehow as files which aren't committed to the image.

Related issues

• Proposal: Dockerfile BINDMOUNT for secure- and/or offline Dockerfile build environments
• Proposal: Dockerfile add BIND_CONTEXT
• Proposal: SLINK instruction for Dockerfile
• Secrets: write-up best practices, do's and don'ts, roadmap

[thaJeztah]

If we allowed volumes during build, the volume could also use a volume-driver, thinking of the Keywhiz driver (I think I mentioned that in #13490)

[NikolausDemmel]

Additional possible solution: Support tmpfs mounts during build, similar to what is possible during run since 1.10: #13587

[jdiaz5513]

call me crazy, but can't the ARG instruction be modified so that it doesn't store the build arg itself in the metadata, but just a (non-reversible) hash of it? that'll keep the secret itself out of any persistent storage and preserve the ability to cache based on the arg value.

[cpuguy83]

@jdiaz5513 secrets in environment variables are not secret.

See #28079 for build secrets.

[jdiaz5513]

Very happy to see that PR. That's a much better solution! 😄

[AkihiroSuda]

docker build --secret is finally available in Docker 18.09 https://medium.com/@tonistiigi/build-secrets-and-ssh-forwarding-in-docker-18-09-ae8161d066