ecr-assets: can't use docker build options like --ssh/--secret available when BUILDKIT is enabled

[hizvi]

docker build options --ssh / --secret can not be used with aws-ecs.AssetImage or aws-ecr-assets.DockerImageAsset

these options are available with docker build when DOCKER_BUILDKIT=1 is enabled.

Use Case

Docker image builds may require access to private resources that require ssh keys and/or secrets. Docker BuildKit allows mounting them safely.

Proposed Solution

The docker utility in cdk already has options for build args and such. the --ssh and --secret options can be implemented similarly.

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[peterwoodworth]

@SoManyHs can you comment on why this is an ecr-assets issue?

[eladb]

Seems like a useful addition, contributions are welcome.

[rob3c]

Lack of support for BuildKit options like --secret and --ssh is a problem everywhere in the codebase where a docker build command is created:

• packages/@aws-cdk/core/lib/bundling.ts
• packages/cdk-assets/lib/private/docker.ts
• maybe elsewhere

None of the modern docker args like those for BuildKit are explicitly supported via options params, and there's no mechanism for decorating any CDK-created docker commands with additional args to allow for CLI updates that haven't been coded for yet in the CDK.

In the meantime, I've posted a placeholder solution for my use cases to this gist:

https://gist.github.com/rob3c/8bf845918bc5270c5e22da0674081f90

It has functions assetCodeFromDockerBuildKitBuild() and dockerImageFromBuildKitBuild().

Here's sample usage showing lambda code built using BuildKit --secret and --ssh args along with an extra Docker --progress arg:

new aws_lambda.Function(this, 'MyLambda', {
  runtime: aws_lambda.Runtime.DOTNET_CORE_3_1,
  code: assetCodeFromDockerBuildKitBuild(buildContextDir, {
    buildArgs: { CONFIG: 'Release' },
    secrets: { nuget_config: 'NuGetPrivateFeed.Config' },
    additionalArgs: {
      '--progress': 'plain',
      '--ssh': 'myserver=$HOME/.ssh/myserver_rsa',
    },
  }),
  handler: 'MyAssembly::MyNamespace.MyHandlerClass::MyHandlerMethod',
});

[hxy1991]

@peterwoodworth @eladb
Hello, is this feature being implemented?

How can I achieve the same effect as "DOCKER_BUILDKIT=1 docker build --secret id=aws,src=$HOME/.aws/credentials --progress=plain" through awscdk/awsecrassets

asset := awsecrassets.NewDockerImageAsset(stack, jsii.String("dockerImage"), &awsecrassets.DockerImageAssetProps{
	Directory: jsii.String(path.Join(dir, "./app")),
})

I really need to pass aws/credentials when building the docker image, because I want to import another aws codecommit (golang project) as a module.

package main

import (
	"git-codecommit.eu-central-1.amazonaws.com/v1/repos/xxx.git/service/xxx"
)

[rob3c]

How can I achieve the same effect as "DOCKER_BUILDKIT=1 docker build --secret id=aws,src=$HOME/.aws/credentials --progress=plain" through awscdk/awsecrassets

@hxy1991 See my message and the gist I posted a link to. There are functions that produce DockerImage and AssetCode CDK instances. Just add the single source file to a CDK v2 project and you can use the functions for arbitrary Docker BuildKit builds with the CDK. Otherwise, you'll be stuck waiting for this issue to be addressed that's been open for 7 months and counting now. It doesn't seem to be a priority.

[RichiCoder1]

@eladb as a simple half step to adding all the new BuildKit args, would a generic additionalArgs escape hatch be acceptable?

[danw-mpl]

@rob3c Would you know how to use your code with an ecs.ContainerImage.fromAsset(...)?

[lox]

Buildkit is now the default in Docker for Mac. This means pretty much any of the docker build integrations currently across cdk won't work.

#21990

[newit-manhp]

It seem currently cdk not support with ssh/secret option.
To build docker image with private git repo access, I can workaround with this: https://vsupalov.com/build-docker-image-clone-private-repo-ssh-key/
Using ARG + multiple stage + buildArg to build the image

[simonloach]

Please work on this, this is a blocker for my team

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[rcraigfiedorek]

@hizvi could this issue be reopened? It has only been partially solved: the --secret option is now available but --ssh still is not.