Azure-devops-docs: Copy secure file to a build image using a Dockerfile

[anlatsko]

I am trying to copy a secure file using a Dockerfile. I have tried using the CopyFiles@2 task to move the file to both '$(Build.SourcesDirectory)' and '$(System.DefaultWorkingDirectory)'. I have also tried to pass the entire $(foo.secureFilePath) path to the Dockerfile as a --build-arg but it was unable to find the full path. I am able to copy files from where the Dockerfile is stored within the repo.

steps:

# download foo.tgz
- task: DownloadSecureFile@1
  name: foo
  inputs: 
    secureFile: foo.tgz 

- task: CopyFiles@2
  inputs:
    sourceFolder: $(foo.secureFilePath)
    contents: '*' 
    targetFolder: '$(System.DefaultWorkingDirectory)'

...

- script: docker build -f Dockerfile -t 'build-and-push-foo:$(build.buildId)' --build-arg BUILDSRC=$(System.DefaultWorkingDirectory)` .

I attempt to access the file in the Dockerfile like this:

FROM python:3
MAINTAINER "Annie Latsko" <[email protected]>

ARG BUILDSRC
ENV BUILDSRC_ENV=$BUILDSRC

# add foo
COPY "${BUILDSRC_ENV}/foo.tgz" / 

but when I build, Docker cannot find ${BUILDSRC_ENV}/foo.tgz.

Is there a way to copy a secure file using a Dockerfile?

[anlatsko]

Update:

In order to access the file from the Dockerfile, instead of using the CopyFiles@2 task, you can just straight up use a snippet like this to copy it into the correct context.

# download the foo.tgz
- task: DownloadSecureFile@1
  name: foo
  inputs: 
    secureFile: foo.tgz

- script: cp $(foo.secureFilePath) .
  displayName: 'moving foo.tgz into the Dockerfile context'

- script: docker build -f Dockerfile -t 'avcontainerreg.azurecr.io/build-and-push-foo$(build.buildId)' 
  displayName: 'docker build'

and then access it in the Dockerfile like this:

# copy foo script
COPY "foo.tgz" /

This might be too basic, but it might be useful to have this in the docs. If you disagree, that's totally cool. Feel free to close this issue whenever you're ready.

[shashankbarsin]

@anlatsko we are working on a set of documents to be introduced under How-to Guides section of our documentation. Let me try to include the snippet in one of these guides :)

[brbarnett]

Update:

In order to access the file from the Dockerfile, instead of using the CopyFiles@2 task, you can just straight up use a snippet like this to copy it into the correct context.

# download the foo.tgz
- task: DownloadSecureFile@1
  name: foo
  inputs: 
    secureFile: foo.tgz

- script: cp $(foo.secureFilePath) .
  displayName: 'moving foo.tgz into the Dockerfile context'

- script: docker build -f Dockerfile -t 'avcontainerreg.azurecr.io/build-and-push-foo$(build.buildId)' 
  displayName: 'docker build'

and then access it in the Dockerfile like this:

# copy foo script
COPY "foo.tgz" /

This might be too basic, but it might be useful to have this in the docs. If you disagree, that's totally cool. Feel free to close this issue whenever you're ready.

This was the right solution for me -- thank you so much for posting the update!