diff --git a/sections/docker/avoid-build-time-secrets.md b/sections/docker/avoid-build-time-secrets.md index 2d33ee08..2b3b899a 100644 --- a/sections/docker/avoid-build-time-secrets.md +++ b/sections/docker/avoid-build-time-secrets.md @@ -15,7 +15,7 @@ A Docker image isn't just a bunch of files but rather multiple layers revealing Dockerfile -``` +```dockerfile # syntax = docker/dockerfile:1.0-experimental FROM node:12-slim @@ -36,19 +36,23 @@ RUN --mount=type=secret,id=npm,target=/root/.npmrc npm ci Dockerfile -``` - +```dockerfile FROM node:12-slim AS build + ARG NPM_TOKEN + WORKDIR /usr/src/app COPY . /dist + RUN echo "//registry.npmjs.org/:\_authToken=\$NPM_TOKEN" > .npmrc && \ npm ci --production && \ rm -f .npmrc + FROM build as prod + COPY --from=build /dist /dist -CMD ["node","index.js"] +CMD ["node", "index.js"] # The ARG and .npmrc won't appear in the final image but can be found in the Docker daemon un-tagged images list - make sure to delete those ``` @@ -63,19 +67,21 @@ CMD ["node","index.js"] Dockerfile -``` - +```dockerfile FROM node:12-slim + ARG NPM_TOKEN + WORKDIR /usr/src/app COPY . /dist + RUN echo "//registry.npmjs.org/:\_authToken=\$NPM_TOKEN" > .npmrc && \ npm ci --production && \ rm -f .npmrc # Deleting the .npmrc within the same copy command will not save it inside the layer, however it can be found in image history -CMD ["node","index.js"] +CMD ["node", "index.js"] ```