Access secrets from a Dockerfile

[marcosnils]

Following up the conversation from this thread: https://discord.com/channels/707636530424053791/1059587293247193320 there's current no straightforward way to send secrets to a build step without making some changes to the Dockerfile.

The current way to achieve this is by leveraging build_args and modifying the Dockerfile as follows:

FROM alpine

ARG SECRET

RUN --mount=type=secret,id=$SECRET,target=/secrets/muysecret \
cat /secrets/muysecret

A possible alternative is to modify the current build step and allow sending secrets:[SecretID!] so Dockerfiles can continue to work without any changes.

type Directory {
   build(context: DirectoryID!, dockerfile: String, build_args: [BuildArg!], secrets:[SecretID!])
}

cc @jlongtine

[shykes]

Is this the same thing as #2550 @sipsma ?

[sipsma]

Is this the same thing

Yes but I'll close my older pre 0.3 one since this one has a proposal in terms of the new API