将屏蔽的Jenkins环境变量传递给Docker容器

Question

I have a password parameter set in my Jenkins build containing some information I want kept secret. The Jenkins build will create a Docker container which needs access to this parameter. Currently, my command looks like such:

docker run -e PASSWORD=${PASSWORD} my_image my_command

This works as I expected it to--the PASSWORD parameter I have set in my build is passed as an environment variable to the Docker container which can then utilize it. This is part of my console output:

+ docker run -e PASSWORD=abc123efg my_image my_command

The problem is that the raw password is shown in the output above. Is there any workaround or alternative solution I can use to pass the masked parameter to my container without exposing it in the output?

Answer 1

有许多插件可以掩盖控制台输出中的特定参数，例如https://wiki.jenkins-ci.org/display/JENKINS/Mask+Passwords+Plugin

Answer 2

Passing sensitive information as plaintext imho is not a good choice even if masked. If you control the build pipeline then it might be a more robust option to go with a shared secret approach instead. It's relatively straightforward to implement and well documented. From a quick google search I'll pick http://bigthinkingapplied.com/key-based-encryption-using-openssl/ which explains it quite nicely. In a nutshell...

• Create a random file ("shared secret") and make it available in your build system as well as in the docker container
• Encrypt the password using the shared secret
• Pass the encrypted password to the docker container
• In the docker container, use the shared secret to decrypt the password