如何为 gitlab-runner CI 安装/重用 docker-compose 秘密？

Question

To be clear, I am talking about the secrets configuration available for docker-compose 3.x.
I am not talking about passing secrets keys/tokens using environment variables (from host or from Gitlab CI/CD settings).

Let's say I have this docker-compose configuration:

version: "3.7"

services:
  my-app:
    image: ubuntu:18.04
    container_name: my-app-container
    command: tail -f /dev/null
    secrets:
      - my_app_secrets

secrets:
  my_app_secrets:
    file: /path/to/secrets.txt

When I start the container manually

$ docker-compose up -d
$ docker-compose exec my-app bash

A /run/secrets/my_app_secrets becomes available inside the container, containing the same exact contents as secrets.txt . The path /run/secrets/ is defined by the secrets configuration.

Now I need to use this same setup for a Gitlab CI pipeline. Unfortunately, I can't seem to find the configuration to put in .gitlab-ci.yml or in the /etc/gitlab-runner/config.toml that will allow me to specify the same secrets configuration. I am sure it is not mounted because I use a custom ENTRYPOINT script that checks for the /run/secrets/my_app_secrets file and it is not there.

if [[ ! -e "/run/secrets/my_app_secrets" ]];
then
    print_error "Did not find mounted app secrets from host"
    return 1
fi

The current solution I have now is to use the volumes configuration under the [runners.docker] section, and mount the /path/to/secrets.txt as a regular volume.

volumes = [
    "/path/to/secrets.txt:/run/secrets/my_app_secrets"
]

But I think that sort of duplicates the configuration and I am manually specifying the /run/secrets/secret_name path.

Is there another way to specify the secrets config to the gitlab-runner?

ENV details:

• Gitlab CE 12.8.6
• gitlab-runner 12.7.1
• Docker 19.03.6
• docker-compose 1.24.0

Answer 1

It seems I misunderstood the usage of the secrets configuration.

Apparently, it is designed to be used for Docker Swarms.
From the Manage sensitive data with Docker secrets docs:

Note : Docker secrets are only available to swarm services, not to standalone containers.

It still can be defined in the docker-compose file for non-swarm, standalone containers (like in the sample docker-compose file in my question) and it would still add a /run/secrets/secret-name to your container. However, it behaves like a regular bind mount.

From this Github issue on using Docker secrets without a swarm:

In docker-compose /run/secrets is just a bind mount to the host.
Those secrets are not deployed to a swarm.

So, for gitlab-runner jobs, you could emulate the secrets feature with a regular mount:

volumes = [
    "/path/to/my_app_secrets:/run/secrets/my_app_secrets"
]