11

I build container from below Dockerfile:

FROM ubuntu:14.04
...
RUN apt-get update && apt-get install -y vim
#RUN ssh-keygen -f /root/.ssh/id_rsa -N strongpass123$%^
RUN ssh-keygen -f /root/.ssh/id_rsa
...

I do it quite rarely, but there is many command before using of ssh-keygen and after it.

I know that I can do it from script through docker exec -it thirsty_darwin sh script.sh and then tag image and then use chaining of containers (images), but it is not as clear solution as I want.

Even worst case is with ssh-add ~/.ssh/id_rsa when I have to use expect tool. Expect tool has hardcoded my password. I do not want to do it.

15

Generally, you should not include any secrets in Docker images. See this answer for more on this topic.

Docker does not support interactive builds for good reasons as explained in this issue.

If you really need to do this, you can use docker commit like so:

docker build -t thirsty_darwin_base /path/to/Dockerfile
docker run -it --name=thirsty_darwin_changes thirsty_darwin_base /bin/bash
# do interactive stuff in the shell, then exit
docker commit thirsty_darwin_changes thirsty_darwin

Now thirsty_darwin has your interactive changes.

Update: Docker has released more comprehensive secrets management since this answer was written.

  • As I mentioned I had found that solution, but the first link (this answer) has nice workaround for my problem. I will mount key through VOLUME from host instead of creating my own in container. Thanks! – koralgooll Feb 19 '16 at 11:24
  • 1
    I would urge not doing a docker commit normally though - it can paint you into a bit of a 'golden image' corner. – Sobrique Feb 19 '16 at 11:43
  • That's a good point @Sobrique. This is one of the reasons Docker discourages interactive or otherwise non-deterministic builds – Matt Vollrath Feb 19 '16 at 11:53
  • So is Docker used to build only simply machines? Because many many installations will require user interaction. I can't user Dockerfile in my build just because I need to install SAGE and it ask some questions to user. – Magno C Nov 23 '17 at 20:07
  • @MagnoC, no you can build anything with Docker. The idea behind Dockerfiles is that you always want the same outcome when run. Interactive inputs could change that. As Matt said, you can commit an altered container into an image. That's what I've been doing at least.. – musicliftsme Jan 26 '18 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.