docs: docker-and-private-modules (#285)
* Update docker-and-private-modules.mdx Example of how to use `--secret` flag to not expose your npm token in the final docker image. * Update content/integrations/integrating-npm-with-external-services/docker-and-private-modules.mdx --------- Co-authored-by: Myles Borins <mylesborins@github.com>
Mat Zaremba committed
Mar 16, 2023 at 16:12 UTC
373f8c948ccfa49fed0fc12a4a279e6b03efa331
1 file changed
+23
-39
content/integrations/integrating-npm-with-external-services/docker-and-private-modules.mdx
+23
-39
@@ -4,87 +4,71 @@ redirect_from:
4
- /private-modules/docker-and-private-modules
5
---
6
7
-To install private npm packages in a Docker container, you will need to use Docker's build-time variables.
7
+To install private npm packages in a Docker container, you will need to use [Docker build secrets](https://docs.docker.com/develop/develop-images/build_enhancements/#new-docker-build-secret-information).
8
9
## Background: runtime variables
10
11
-You cannot install private npm packages in a Docker container using only runtime variables. Consider the following Dockerfile:
11
+You cannot install private npm packages in a Docker container using only runtime variables. Consider the following Dockerfile:
12
13
```
14
FROM node
15
16
-COPY package.json package.json
16
+COPY package.json package.json
17
RUN npm install
18
19
# Add your source files
20
-COPY . .
21
-CMD npm start
20
+COPY . .
21
+CMD npm start
22
```
23
24
Which will use the official [Node.js](https://hub.docker.com/_/node) image, copy the `package.json` into our container, installs dependencies, copies the source files and runs the start command as specified in the `package.json`.
25
26
In order to install private packages, you may think that we could just add a line before we run `npm install`, using the [ENV parameter](https://docs.docker.com/engine/reference/builder/#env):
27
28
-```
28
+```docker
29
ENV NPM_TOKEN=00000000-0000-0000-0000-000000000000
30
```
31
32
However, this doesn't work as you would expect, because you want the npm install to occur when you run `docker build`, and in this instance, `ENV` variables aren't used, they are set for runtime only.
33
34
-Instead of run-time variables, you must use a different way of passing environment variables to Docker, available since Docker 1.9: the [ARG parameter](https://docs.docker.com/engine/reference/builder/#arg).
35
-
36
-## Create and check in a project-specific .npmrc file
37
-
38
-A complete example that will allow you to use `--build-arg` to pass in your NPM_TOKEN requires adding a `.npmrc` file to the project.
34
+Instead of run-time variables, you must use Docker build secrets.
35
40
-Use a project-specific `.npmrc` file with a variable for your token to securely authenticate your Docker image with npm.
41
-
42
-1. In the root directory of your project, create a custom <a href="https://docs.npmjs.com/cli-documentation/files/npmrc">`.npmrc`</a> file with the following contents:
36
+## Update the Dockerfile
37
44
- ```
45
- //registry.npmjs.org/:_authToken=${NPM_TOKEN}
46
- ```
38
+The Dockerfile that takes advantage of this has a few more lines in it than the earlier example that allows us to use your global `.npmrc` and the access token created when running `npm login` command (if you haven't run it already - do so before moving on).
39
48
- **Note:** that you are specifying a literal value of `${NPM_TOKEN}`. The npm cli will replace this value with the contents of the `NPM_TOKEN` environment variable. Do **not** put a token in this file.
40
+```dockerfile
41
+# https://docs.npmjs.com/docker-and-private-modules
42
+FROM node:18
43
50
-2. Check in the `.npmrc` file.
44
+ENV APP_HOME="/app"
45
52
-## Update the Dockerfile
46
+WORKDIR ${APP_HOME}
47
54
-The Dockerfile that takes advantage of this has a few more lines in it than the earlier example that allows us to use the `.npmrc` file and the `ARG` parameter:
48
+COPY package*.json ${APP_HOME}/
49
56
-```
57
-FROM node
50
+RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm install
51
59
-ARG NPM_TOKEN
60
-COPY .npmrc .npmrc
61
-COPY package.json package.json
62
-RUN npm install
63
-RUN rm -f .npmrc
52
+COPY . ${APP_HOME}/
53
65
-# Add your source files
66
-COPY . .
54
CMD npm start
55
+
56
```
57
70
-This adds the expected `ARG NPM_TOKEN`, but also copies the `.npmrc` file, and removes it when `npm install` completes.
58
+This will configure your Dockerfile to receive `.npmrc` file via build secrets, that will leave no trace after npm dependency installation is done.
59
60
## Build the Docker image
61
62
To build the image using the above Dockerfile and the npm authentication token, you can run the following command. Note the `.` at the end to give `docker build` the current directory as an argument.
63
76
-```
77
-docker build --build-arg NPM_TOKEN=${NPM_TOKEN} .
64
+```shell
65
+docker build . -t secure-app-secrets:1.0 --secret id=npmrc,src=$HOME/.npmrc
66
```
67
80
-This will build the Docker image with the current `NPM_TOKEN` environment variable, so you can run `npm install` inside your container as the current logged-in user.
68
+This will build the Docker image with the access token coming from your global `.npmrc` file received via build secrets, so you can run `npm install` inside your container as the current logged-in user.
69
70
<Note>
71
84
-**Note:** Even if you delete the `.npmrc` file, it will be kept in the commit history. To clean your secrets entirely, make sure to squash them.
85
-
86
-**Note:** You may commit the `.npmrc` file under a different name, e.g. `.npmrc.docker` to prevent local build from using it.
87
-
88
-**Note:** You may need to specify a working directory different from the default `/` otherwise some frameworks like Angular will fail.
72
+**Note:** You may need to specify a working directory different from the default `/` otherwise some frameworks like Angular will fail.
73
74
</Note>