Question

Context

我在Dockerfile和Docker-compose之间 ju笑,以图示最佳安全做法,以部署我的cker形象,并将其推向cker户登记册,使每个人都能使用。

目前,我有一份快车牌申请,利用AWS AP象征性地为AWS服务。我试图拿出一种能够在Docker为Windows(GUI)和Docker为短链氯化石蜡工作的解决办法。

In Docker Windows GUI it s well and clear that after I pull the image from the registry I can add API tokens in the environment of the image and spin a container.

I need to know

在谈到Docker公司时,Im试图用一种方式,通过Dockerfile或Docker-compose.yml,用AWS AP来树立形象。

Things I tried

Followed the solution from this blog

As I said earlier if I do something like that as mentioned in the blog. It s fine for my personal use. A user who pulls my docker image from the registry will also be having my AWS Secrets. How do I handle this situation in a better way

Current state of Dockerfile

FROM python:3.10

# Set the working directory to /app
WORKDIR /src

# Copy the current directory contents into the container at /app
ADD ./ /src

# Install any needed packages specified in requirements.txt
#RUN /usr/local/bin/python -m pip install --upgrade pip
RUN pip install --upgrade pip
RUN pip install --no-cache-dir -r requirements.txt

# Make port 80 available to the world outside this container
EXPOSE 8000

# Run app.py when the container launches
CMD ["python", "main.py"]

Answer 1

这里,你如何利用Docker建筑时代的秘密管理Docker的秘密:

Firstly, create a file containing your secret. For instance, let s say you have an AWS API token, create a file named aws_token.txt and place your token inside it.

现在,修改你的Dockerfile,在建筑过程中使用建筑时代的秘密。

下面是你如何能够做到这一点的一个例子:

FROM python:3.10

# Set the working directory to /app
WORKDIR /src

# Copy the current directory contents into the container at /app
ADD ./ /src

# Install any needed packages specified in requirements.txt
RUN pip install --upgrade pip
RUN pip install --no-cache-dir -r requirements.txt

# Make port 80 available to the world outside this container
EXPOSE 8000

# Use build-time secret to set environment variable
ARG AWS_TOKEN
ENV AWS_TOKEN=$AWS_TOKEN

# Run app.py when the container launches
CMD ["python", "main.py"]

建设多克图像: 当你打造Docker的形象时,把建筑时间秘密作为建筑理由。在这方面,你可以做些什么:

docker build --build-arg AWS_TOKEN=$(cat aws_token.txt) -t your_image_name .

最后,在建筑过程中,美国妇女论坛从 a子中ken。作为建筑时间的争辩,将安全地向Docker图像传送t文档。然后作为集装箱内的一种环境变量加以利用。

As Docker build-time secrets are stored in the Docker build cache, which means they won t persist in the final image. This helps maintain the security of your secrets.

Context

I need to know

Things I tried

Current state of Dockerfile

友情链接