0

Context

I'm juggling between Dockerfile and docker-compose to figure out the best security practice to deploy my docker image and push it to the docker registry so everyone can use it.

Currently, I have a FastAPI application that uses an AWS API token for an AWS Service. I'm trying to figure out a solution that can work in both Docker for Windows (GUI) and Docker for Linux.

In Docker Windows GUI it's well and clear that after I pull the image from the registry I can add API tokens in the environment of the image and spin a container.

I need to know

When it comes to Docker for Linux, I'm trying to figure out a way to build an image with an AWS API token either via Dockerfile or docker-compose.yml.

Things I tried

  • Followed the solution from this blog

As I said earlier if I do something like that as mentioned in the blog. It's fine for my personal use. A user who pulls my docker image from the registry will also be having my AWS Secrets. How do I handle this situation in a better way

Current state of Dockerfile

FROM python:3.10

# Set the working directory to /app
WORKDIR /src

# Copy the current directory contents into the container at /app
ADD ./ /src

# Install any needed packages specified in requirements.txt
#RUN /usr/local/bin/python -m pip install --upgrade pip
RUN pip install --upgrade pip
RUN pip install --no-cache-dir -r requirements.txt

# Make port 80 available to the world outside this container
EXPOSE 8000

# Run app.py when the container launches
CMD ["python", "main.py"]
Tejas
  • 35
  • 1
  • 10
  • You definitely shouldn't put the credential in the Dockerfile: you'd have to rebuild the image to deploy the same code in different environments, and it'd be very easy for someone else to get the credential back out of the image. Are you asking [What is the best way to pass AWS credentials to a Docker container?](https://stackoverflow.com/questions/36354423/what-is-the-best-way-to-pass-aws-credentials-to-a-docker-container) Or more generally about [Docker and securing passwords](https://stackoverflow.com/questions/22651647/docker-and-securing-passwords)? – David Maze Dec 03 '22 at 11:03
  • @DavidMaze How do I even publish my image without my AWS Credentials in the image. – Tejas Dec 05 '22 at 08:41
  • Are you pushing to ECR? You'd use a command like [`aws ecr get-login-password`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/get-login-password.html) to authenticate, and then `docker push` the image. That uses credentials from your host environment, not the image. – David Maze Dec 05 '22 at 11:37

0 Answers0