Skip to content

🖐️ Caching issues with Dockerfile builds that use secrets #10325

@mjrusso

Description

@mjrusso

What happened? What did you expect to happen?

I have a project that installs dependencies from a private registry.

Auth credentials for this registry are Dagger secrets:

    @function
    async def build(
        self,
        source: Annotated[Directory, DefaultPath("/")],
        python_registry_username: Secret,
        python_registry_password: Secret,
    ) -> Container:
        return dag.container().build(
            source,
            secrets=[
                dag.set_secret(
                    "python-registry-username", await python_registry_username.plaintext()
                ),
                dag.set_secret(
                    "python-registry-password", await python_registry_password.plaintext()
                ),
            ],
        )

Relevant portion of the corresponding Dockerfile:

RUN --mount=type=secret,id=python-registry-username,env=UV_INDEX_REGISTRY_USERNAME \
    --mount=type=secret,id=python-registry-password,env=UV_INDEX_REGISTRY_PASSWORD \
    uv sync --frozen --no-install-project

This layer is never cached (or, more accurately, subsequent builds always regenerate this), which makes builds significantly slower than they need to be.

Is there anything I can do to speed up builds? It's unclear based on my quick reading of the issue tracker whether this is expected (and/or intended).

Note that I believe this is the same issue that was reported by @MatthiasGrandl in #9354 (cc @jedevc), but that original ticket was about a different issue, so I'm spinning this out into its own ticket.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions