How to pass secrets to docker?

[mmazurowski]

Hey 👋

I am working on custom lambda docker image and need to pass secret which will allow me to pull some private dependencies from npm during build stage.

As far as I understand my options are:

1. Build docker image "manually" in CI/CD.
2. Figure out way how to pass it via serverless to the docker build command.

Can someone confirm that option number 2 is possible? If not, I will just go to the old-fashioned way 😄

[pgrzesik]

Hey @mmazurowski 👋

It is possible to pass build args via serverless config with buildArgs property. You can find the details here: https://www.serverless.com/framework/docs/providers/aws/guide/functions#referencing-container-image-as-a-target

I hope that resolves your issue. 🙌

[jamest-spring]

Hello @pgrzesik ,

Thanks for your response, but buildArgs are not an appropriate solution for passing build time secrets because they'll get built into the image and accessible. See https://docs.docker.com/engine/reference/builder/#arg

Thanks,
James

[pgrzesik]

Hey @jamest-spring 👋 I agree that using build args might not be the best way of handling sensitive secrets, however at the moment that's the only way that is supported by Serverless Framework

[insidewhy]

I've added a PR to implement secrets here: #12428