Adding ability to inject secrets into compose build command

pkg/composer/serviceparser/build.go

@@ -24,14 +24,16 @@ import (
 
 	"github.com/compose-spec/compose-go/types"
 	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/identifiers"
 	"github.com/containerd/nerdctl/pkg/reflectutil"
 
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/sirupsen/logrus"
 )
 
 func parseBuildConfig(c *types.BuildConfig, project *types.Project, imageName string) (*Build, error) {
 	if unknown := reflectutil.UnknownNonEmptyFields(c,
-		"Context", "Dockerfile", "Args", "CacheFrom", "Target", "Labels",
+		"Context", "Dockerfile", "Args", "CacheFrom", "Target", "Labels", "Secrets",
 	); len(unknown) > 0 {
 		logrus.Warnf("Ignoring: build: %+v", unknown)
 	}
@@ -82,6 +84,33 @@ func parseBuildConfig(c *types.BuildConfig, project *types.Project, imageName st
 		}
 	}
 
+	for _, s := range c.Secrets {
+		fileRef := types.FileReferenceConfig(s)
+		if err := identifiers.Validate(fileRef.Source); err != nil {
+			return nil, fmt.Errorf("secret source %q is invalid: %w", fileRef.Source, err)
+		}
+		projectSecret, ok := project.Secrets[fileRef.Source]
+		if !ok {
+			return nil, fmt.Errorf("build: secret %s is undefined", fileRef.Source)
+		}
+		var src string
+		if filepath.IsAbs(projectSecret.File) {
+			logrus.Warnf("build.secrets should be relative path, got %q", projectSecret.File)
+			src = projectSecret.File
+		} else {
+			var err error
+			src, err = securejoin.SecureJoin(ctxDir, projectSecret.File)
+			if err != nil {
+				return nil, err
+			}
+		}
+		id := fileRef.Source
+		if fileRef.Target != "" {
+			id = fileRef.Target
+		}
+		b.BuildArgs = append(b.BuildArgs, "--secret=id="+id+",src="+src)
+	}
+
 	b.BuildArgs = append(b.BuildArgs, ctxDir)
 	return &b, nil
 }

pkg/composer/serviceparser/build_test.go

@@ -43,6 +43,18 @@ services:
       target: bartgt
       labels:
         bar: baz
+      secrets:
+        - source: src_secret
+          target: tgt_secret
+        - simple_secret
+        - absolute_secret
+secrets:
+  src_secret:
+    file: test_secret1
+  simple_secret:
+    file: test_secret2
+  absolute_secret:
+    file: /tmp/absolute_secret
 `
 	comp := testutil.NewComposeDir(t, dockerComposeYAML)
 	defer comp.CleanUp()
@@ -67,10 +79,14 @@ services:
 	bar, err := Parse(project, barSvc)
 	assert.NilError(t, err)
 
-	t.Logf("bar: %+v", foo)
+	t.Logf("bar: %+v", bar)
 	assert.Equal(t, "barimg", bar.Image)
 	assert.Equal(t, true, bar.Build.Force)
 	assert.Equal(t, project.RelativePath("barctx"), lastOf(bar.Build.BuildArgs))
 	assert.Assert(t, in(bar.Build.BuildArgs, "--target=bartgt"))
 	assert.Assert(t, in(bar.Build.BuildArgs, "--label=bar=baz"))
+	secretPath := project.RelativePath("barctx")
+	assert.Assert(t, in(bar.Build.BuildArgs, "--secret=id=tgt_secret,src="+secretPath+"/test_secret1"))
+	assert.Assert(t, in(bar.Build.BuildArgs, "--secret=id=simple_secret,src="+secretPath+"/test_secret2"))
+	assert.Assert(t, in(bar.Build.BuildArgs, "--secret=id=absolute_secret,src=/tmp/absolute_secret"))
 }