我正在尝试使用Bitbucket Pipeline将Docker映像部署到AWS ECR。在requirements.txt
文件中,我有一个Python包,它来自我项目中的私有Bitbucket存储库。
不幸的是,我的Bitbucket管道构建一直失败。我想我错过了身份验证或pip install
中的一些基本步骤,但我似乎找不到此用例的正确文档。
在这个Bitbucket community post之后,我在管道项目中生成了一个SSH密钥,并将其添加到包存储库中的Access Keys中。然后我遵循this post并将文件结构化为:
- Dockerfile**
# syntax = docker/dockerfile:1.2
FROM python:3.9-slim
WORKDIR /src
# Install git to download private repo
RUN apt-get update && apt-get install -y git
# Add Bitbucket SSH key to install private repo
ARG SSH_PRIVATE_KEY
RUN mkdir ~/.ssh/
RUN echo "${SSH_PRIVATE_KEY}" > ~.ssh/id_rsa
RUN chmod 600 ~/.ssh/id_rsa
RUN touch ~/.ssh/known_hosts
RUN ssh-keyscan bitbucket.org >> ~/.ssh/known_hosts
RUN eval $(ssh-agent -s)
RUN ssh-add ~/.ssh/id_rsa
# Install Python dependencies
RUN pip install --upgrade pip setuptools
COPY requirements.txt requirements.txt
# requirements.txt also includes private repo package
RUN pip install --no-cache-dir -r requirements.txt
# Copy code into `src` folder
COPY src/ /src
# Set up environment variables & secrets
RUN --mount=type=secret,id=keys cat /run/secrets/keys \
&& python -m configs.parser
ENTRYPOINT ["python", "main.py"]
- bitbucket-pipelines. yml**
image: atlassian/default-image:2
pipelines:
branches:
master:
- step:
name: Build and AWS Setup
services:
- docker
script:
# Export repo variables to .env file
- export ENV_PATH=src/configs/.env
- echo AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID >> $ENV_PATH
- echo AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY >> $ENV_PATH
- export SSH_PRIVATE_KEY=`cat /opt/atlassian/pipelines/agent/data/id_rsa`
- export TIMESTAMP="$(date +%Y%m%d%H%M%S)"
# Build docker image with secrets mounted
- export DOCKER_BUILDKIT=1
- docker build --build-arg SSH_PRIVATE_KEY --secret id=keys,src=$ENV_PATH -t $AWS_ECR_REPO .
# use pipe to push the image to AWS ECR
- pipe: atlassian/aws-ecr-push-image:1.3.0
variables:
AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
AWS_DEFAULT_REGION: us-east-1
IMAGE_NAME: $AWS_ECR_REPO
TAGS: "latest $TIMESTAMP $BITBUCKET_BUILD_NUMBER"
我的管道运行在docker build
的第5步失败,错误是:executor failed running [/bin/sh -c echo "${SSH_PRIVATE_KEY}" > ~.ssh/id_rsa]: exit code: 2
任何帮助与此将不胜感激!
1条答案
按热度按时间wljmcqd81#
你不应该将RSA私钥作为参数传递,也不应该将它们转储到你正在构建的docker镜像中。这样,私钥最终将暴露在图像层中。
您应该使用
(See https://support.atlassian.com/bitbucket-cloud/docs/run-docker-commands-in-bitbucket-pipelines/#Docker-BuildKit-restrictions)
对于known_hosts内容:为了保护镜像构建器不被欺骗,我建议不要接受任何可以在构建时扫描的密钥。
要么供应商(并在VCS下保持)在Docker构建上下文中的必要ssh服务器指纹,要么挂载(不一定是秘密的)外部管理的known_hosts。例如,由Bitbucket Pipelines管理的一个已经具有维护的bitbucket.org ssh指纹:https://support.atlassian.com/bitbucket-cloud/docs/set-up-pipelines-ssh-keys-on-linux/#Update-the-known-hosts