beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Clarify warning against using build-time variables for secrets

Browse source 
Signed-off-by: Dave Henderson <dhenderson@gmail.com>
(cherry picked from commit 9af24ba3ac)
Signed-off-by: Tibor Vass <tibor@docker.com>
This commit is contained in:
Dave Henderson 2016-07-11 21:18:03 -04:00 committed by Tibor Vass
parent 56ab840f37
commit 5dafcf2170
2 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
docs/reference/builder.md
View file

@ -1292,8 +1292,9 @@ subsequent line 3. The `USER` at line 4 evaluates to `what_user` as `user` is
defined and the `what_user` value was passed on the command line. Prior to its definition by an
`ARG` instruction, any use of a variable results in an empty string.
> **Note:** It is not recommended to use build-time variables for
> passing secrets like github keys, user credentials etc.
> **Warning:** It is not recommended to use build-time variables for
> passing secrets like github keys, user credentials etc. Build-time variable
> values are visible to any user of the image with the `docker history` command.
You can use an `ARG` or an `ENV` instruction to specify variables that are
available to the `RUN` instruction. Environment variables defined using the

5
man/Dockerfile.5.md
View file

@ -376,8 +376,9 @@ A Dockerfile is similar to a Makefile.
defined and the `what_user` value was passed on the command line. Prior to its definition by an
`ARG` instruction, any use of a variable results in an empty string.
> **Note:** It is not recommended to use build-time variables for
> passing secrets like github keys, user credentials etc.
> **Warning:** It is not recommended to use build-time variables for
> passing secrets like github keys, user credentials etc. Build-time variable
> values are visible to any user of the image with the `docker history` command.
You can use an `ARG` or an `ENV` instruction to specify variables that are
available to the `RUN` instruction. Environment variables defined using the