New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Don't send ~/.docker/config.json by default #5
Comments
That's makes sense, the original Idea was to write simple wrapper cover the kaniko functionality: Call this:
almost any option should be working as native one. Meanwhile, I agree with the security risks you mention, I'm considering to add
Could you give me an example, how it can be implemented with native kaniko? |
I don't know exactly how it works. The Google documentation says to invoke gcloud auth configure-docker after my {
"auths" : {
"https://gcr.io" : {
},
"gcr.io" : {
}
},
"experimental" : "disabled",
"HttpHeaders" : {
"User-Agent" : "Docker-Client/18.09.2 (darwin)"
},
"credHelpers" : {
"us.gcr.io" : "gcloud",
"asia.gcr.io" : "gcloud",
"marketplace.gcr.io" : "gcloud",
"gcr.io" : "gcloud",
"eu.gcr.io" : "gcloud",
"staging-k8s.gcr.io" : "gcloud"
},
"credsStore" : "desktop",
"stackOrchestrator" : "swarm",
"credSstore" : "osxkeychain"
}
My cluster's default service account has write permission to gcr (which is probably not a good idea.. ) so it doesn't require any secret. This is the recommend way: |
Hi, since Also the support for variable |
The current implementation sends
~/.docker/config.json
as a secret if it exist. This isn't great:As a result, I think it would be best to place this pushing of
~/.docker/config.json
behind a dedicated flag and default to not sending any secrets.The text was updated successfully, but these errors were encountered: