如何使用未提交的本地证书文件构建具有 GitHub 操作的 Docker 映像

Question

I have set up a GitHub actions workflow, where when I push code to a branch in my repo, GitHub actions help me build an image of that repo and push it to Docker Hub, which work fine.

The thing is that I now have certificate-files that I want to keep locally (ie not push up to my GitHub repo) - but that also means that the GitHub actions don't have access to them when building the image, and thus they don't get included in the built image on Docker Hub which I use to pull from into my production server - where I now don't have my certificate files. How can I set up GitHub actions to in some way build the image by using local files? Or is there a better way to solve this?

My GitHub actions file

name: Build and deploy project to Docker Hub

on:
 push:
   branches:
     - master

jobs:


 build:
   runs-on: 'ubuntu-latest'

   steps:
   - uses: actions/checkout@v2

   - name: Set up Docker Buildx
     uses: docker/setup-buildx-action@v1

   - name: Log in to Docker Hub - Main web app container registry
     uses: docker/login-action@v1
     with:
       username: ${{ secrets.USERNAME }}
       password: ${{ secrets.PASSWORD }}

   - name: Build and push Main web app container image to registry
     uses: docker/build-push-action@v2
     with:
       push: true
       tags: ${{ secrets.USERNAME }}/project:latest
       file: ./Dockerfile.prod

Answer 1

Well now I feel stupid:)

I got all into thinking about how to solve it by including it on the build-stage of the image, and didn't think of that when you start the built image you can choose to use "volumes" that resides on the machine you are starting the docker image from.

It was as simple as:

1. Copy the folder with my certificate files from my local version of my GitHub repo to the remote version of my repo at my server with SCP, for example:

scp -r $(pwd)/Certificates_prod user@server:/path/to/repo/on/server

2. Go into your docker-compose file and go under the container that is supposed to use the certificate-files and add the folder as a mounted volume, for example:

 restart: always image: index.docker.io/username/reponame command: gunicorn myrepo.wsgi:application --bind 0.0.0.0:8000 volumes: - /local/path/to/Certificates_prod:/remote/path/to/your/repo