Pass Jenkins credentials to Docker build for Composer usage

Question

I've got a composer packages in our company's private repository on BitBucket. To access it I need to use credentials stored in Jenkins. Currently the whole build is based on Declarative Pipeline and Dockerfile. To pass credentials to Composer I need those credentials in build stage to pass them to Dockerfile.

How can I achieve it?

I've tried:

// Jenkinsfile
agent {
    dockerfile {
        label 'mylabel'
        filename '.docker/php/Dockerfile'
        args '-v /net/jenkins-ex-work/workspace:/net/jenkins-ex-work/workspace'
        additionalBuildArgs '--build-arg jenkins_usr=${JENKINS_CREDENTIALS_USR} --build-arg jenkins_credentials=${JENKINS_CREDENTIALS} --build-arg test_arg=test'
    }
}

// Dockerfile
ARG jenkins_usr
ARG jenkins_credentials
ARG test_arg

But the args are empty.

I'm not using Docker agents, so I'm only guessing - shouldn't you use double quotes to make string interpolation in the line with `additionalBuildArgs`? — Tupteq, Mar 24 '20 at 13:51

BoomShaka · Answer 1 · 2021-03-26T20:26:10.937

TL;DR Use jenkins withCredentials([sshUserPrivateKey()]) and echo the private key into id_rsa in the container.

EDITED: Removed the "run as root" step, as I think this caused issues. Instead a jenkins user is created inside the docker container with the same UID as the jenkins user that builds the docker container (no idea if that matters, but we need a user with a home dir so we can create ~/.ssh/id_rsa)

For those that suffered like me... My solution is below. It is NOT ideal as:

it risks exposing your private key in the build logs if you are not careful (the below is careful, but it's easy to forget). (Although with that in mind, it appears extracting jenkins credentials is extremely easy for anyone with naughty intentions?)

So use with caution...

In my (legacy) git project, a simple php app with internal git based composer dependencies, I have

Dockerfile.build

FROM php:7.4-alpine
# install git, openssh, composer... whatever u need here, then:
# create a jenkins user inside the docker image
ARG UID=1001
RUN adduser -D -g jenkins -s /bin/sh -u $UID jenkins \
    && mkdir -p /home/jenkins/.ssh \
    && touch /home/jenkins/.ssh/id_rsa \
    && chmod 600 /home/jenkins/.ssh/id_rsa \
    && chown -R jenkins:jenkins /home/jenkins/.ssh
USER jenkins
# I think only ONE of the below are needed, not sure.
RUN echo "Host bitbucket.org\n\tStrictHostKeyChecking no\n" >> /home/jenkins/.ssh/config \ 
    && ssh-keyscan bitbucket.org >> /home/jenkins/.ssh/known_hosts

Then in my Jenkinsfile:

def sshKey = ''

pipeline {
    agent any

    environment {
        userId = sh(script: "id -u ${USER}", returnStdout: true).trim()
    }
    
    stages {
        stage('Prep') {
            steps {
                script {
                    withCredentials([
                        sshUserPrivateKey(
                            credentialsId: 'bitbucket-key',
                            keyFileVariable: 'keyFile',
                            passphraseVariable: 'passphrase',
                            usernameVariable: 'username'
                        )
                    ]) {
                        sshKey = readFile(keyFile).trim()
                    }
                }
            }
        }
        
        stage('Build') {
            agent {
                dockerfile {
                    filename 'Dockerfile.build'
                    additionalBuildArgs "--build-arg UID=${userId}"
                }
            }
            steps {
                // Turn off command trace for next line, as we dont want to log ssh key
                sh '#!/bin/sh -e\n' + "echo '${sshKey}' > /home/jenkins/.ssh/id_rsa"
                // .. proceed with whatever else, like composer install, etc

To be fair, I think some of the RUN commands in the docker container aren't even necessary, or could be run from the jenkins file? ¯_(ツ)_/¯

I think i just got bit by the problem in warning #2 (running as root). The cleanup on my build is now failing with some permissions issue (builds worked fine, then this suddenly started). So currently looking at creating a user in the Dockerfile with the same UID as the jenkins user. No idea if that will help... — BoomShaka, Mar 26 '21 at 20:16

score 0 · Answer 2 · answered Mar 24 '20 at 21:17

0

There was a similar issue, supposedly fixed in PR 327, with pipeline-model-definition-1.3.9

So start checking the version of your plugin.

But heed also the Dockerfile warning:

It is not recommended to use build-time variables for passing secrets like github keys, user credentials etc.
Build-time variable values are visible to any user of the image with the docker history command.

Using buildkit with --secret is a better approach for that.

answered Mar 24 '20 at 21:17

VonC

1,262,500
529
4,410
5,250

This addresses a related problem, but not the one in the question, which is how to pass the credentials as a build arg at all. I'm having that problem too. – Heshy Jan 21 '21 at 15:17

Pass Jenkins credentials to Docker build for Composer usage

2 Answers2