bake: support compose build secrets #1069
Conversation
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
crazy-max
force-pushed
the
compose-build-secrets
branch
from
4ded8e6
to
52d4cb9
Compare
bake/compose.go
Outdated
| func composeToBuildkitSecret(inp compose.ServiceSecretConfig, projectSecrets compose.Secrets) (string, error) { | ||
| psecret := projectSecrets[inp.Source] | ||
| if psecret.External.External { | ||
| return "", fmt.Errorf("unsupported external secret %s", psecret.Name) |
bake/compose.go
Outdated
|
|
||
| // composeToBuildkitSecret converts secret from compose format to buildkit's | ||
| // csv format. | ||
| func composeToBuildkitSecret(inp compose.ServiceSecretConfig, projectSecrets compose.Secrets) (string, error) { |
There was a problem hiding this comment.
Why doesn't this just take psecret as parameter?
crazy-max
force-pushed
the
compose-build-secrets
branch
from
52d4cb9
to
f9f763a
Compare
bake/compose.go
Outdated
| if psecret.File != "" { | ||
| bkattrs = append(bkattrs, "src="+psecret.File) | ||
| } | ||
| if inp.Target != "" { |
There was a problem hiding this comment.
What are these things: targets, uid, gid, mode? These can't be set by the flags but are determined by the definition in Dockerfile.
There was a problem hiding this comment.
Oh my bad I confused the secret mount in the Dockerfile syntax with the secret flag!
Yes typed structure would be nice and also expose a contract in BuildKit so we don't have hardcoded attributes that could potentially drift. |
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
crazy-max
force-pushed
the
compose-build-secrets
branch
from
f9f763a
to
c0f8a83
Compare
@glours Looking at this, adding these fields in the compose-spec might have been out of scope for buildx. |
fixes #1060
Adds support for compose build secrets with bake. Needs to vendor compose-go compose-spec/compose-go@v1.2.1...v1.2.4. See spec https://github.com/compose-spec/compose-spec/blob/master/build.md#secrets.
We can keep the
x-bakesecret field for now imo.Also env secret type is supported with the following format:
I will review our documentation about bake and create dedicated guides for compose and hcl formats for this kind of use cases in a follow-up.
cc @glours @ciaranmcnulty