Skip to content

Improve podman build secrets docs / Makefile validatepr description #25111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jan 28, 2025
Merged

Improve podman build secrets docs / Makefile validatepr description #25111

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0d2431d
docs: Enhance podman build --secret documentation and add examples
hdub-tech Jan 24, 2025
bbf00ec
Makefile: Add validatepr description for 'make help' output
hdub-tech Jan 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -325,7 +325,7 @@ validate: validate-source validate-binaries
# not automated right now. The hope is that eventually the quay.io/libpod/fedora_podman is multiarch and can replace this
# image in the future.
.PHONY: validatepr
validatepr:
validatepr: ## Go Format and lint, which all code changes must pass
$(PODMANCMD) run --rm \
-v $(CURDIR):/go/src/github.com/containers/podman \
--security-opt label=disable \
Expand Down
20 changes: 15 additions & 5 deletions docs/source/markdown/options/secret.image.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,22 @@
####> podman build, farm build
####> If file is edited, make sure the changes
####> are applicable to all of those.
#### **--secret**=**id=id,src=path**
#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]**

Pass secret information used in the Containerfile for building images
in a safe way that are not stored in the final image, or be seen in other stages.
The secret is mounted in the container at the default location of `/run/secrets/id`.
Pass secret information to be used in the Containerfile for building images
in a safe way that will not end up stored in the final image, or be seen in other stages.
The value of the secret will be read from an environment variable or file named
by the "id" option, or named by the "src" option if it is specified, or from an
environment variable specified by the "env" option. See [EXAMPLES](#examples).
The secret will be mounted in the container at `/run/secrets/id` by default.

To later use the secret, use the --mount option in a `RUN` instruction within a `Containerfile`:
To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`:

`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`

The location of the secret in the container can be overridden using the
"target", "dst", or "destination" option of the `RUN --mount` flag.

`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret`

Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets.
17 changes: 17 additions & 0 deletions docs/source/markdown/podman-build.1.md.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -566,6 +566,23 @@ Build image using the specified network when running containers during the build
$ podman build --network mynet .
```

Build an image using a secret stored in an environment variable or file named `mysecret` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`:
```
$ podman build --secret=id=mysecret .
```

Build an image using a secret stored in an environment variable named `MYSECRET` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`:
```
$ podman build --secret=id=mysecret,env=MYSECRET .
$ podman build --secret=id=mysecret,src=MYSECRET,type=env .
```

Build an image using a secret stored in a file named `.mysecret` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`:
```
$ podman build --secret=id=mysecret,src=.mysecret .
$ podman build --secret=id=mysecret,src=.mysecret,type=file .
```

### Building a multi-architecture image using the --manifest option (requires emulation software)

Build image using the specified architectures and link to a single manifest on successful completion:
Expand Down
Loading