嘗試點子在DockerFile中安裝私有倉庫

Question

我正在嘗試安裝一個自定義Python程序包以在Flask Server中運行。 該服務器將在Docker映像中。 因此，我正在嘗試對RUN pip install git+ssh://git@bitbucket.org:teamName/reponame.git@dev#egg=packageName進行某種操作RUN pip install git+ssh://git@bitbucket.org:teamName/reponame.git@dev#egg=packageName但是，我嘗試過的任何方法都RUN pip install git+ssh://git@bitbucket.org:teamName/reponame.git@dev#egg=packageName 。

我嘗試了找到的兩種格式：

1） git+ssh://git@bitbucket.org:teamName/reponame.git@dev#egg=packageName

2） git+ssh://bitbucket.org/team/reponame.git@dev#egg=packageName

這兩種技術都給出類似的錯誤：

fatal: Could not read from remote repository.

  Please make sure you have the correct access rights
  and the repository exists.

要么

ssh: Could not resolve hostname bitbucket.org:TeamName: Name does not resolve
  fatal: Could not read from remote repository. 

要么

root@bitbucket.org: Permission denied (publickey).
  fatal: Could not read from remote repository.

即使我的公鑰已在BitBucket中設置

這是Dockerfile：

 Use an official Python runtime as a parent image
FROM python:3.6-alpine

#Preparation to pull from Github
ARG SSH_PRIVATE_KEY

RUN echo "Oh dang look at that ${SSH_PRIVATE_KEY}"

RUN apk update
RUN apk add --no-cache openssh \
    git

RUN mkdir /root/.ssh/
RUN echo "${SSH_PRIVATE_KEY}" > /root/.ssh/id_rsa

RUN chmod 600 /root/.ssh/id_rsa


RUN touch /root/.ssh/known_hosts
RUN ssh-keyscan bitbucket.org >> /root/.ssh/known_hosts

#install dependencies
RUN apk add --no-cache gcc \
    bash \
    tzdata \
    g++ \
    tiff-dev \
    openssl \
    poppler \
    poppler-dev \
    poppler-utils \
    && pip install --trusted-host pypi.python.org <THE_URL>
    && cp /usr/share/zoneinfo/America/that_place /etc/localtime \
    && echo "America/that_place" >  /etc/timezone \
    && date

# Set the working directory to /app
WORKDIR ./my_dir

# Make port 5000 available to the world outside this container
EXPOSE 5000

#Remove SSH
RUN rm /root/.ssh/id_rsa

# Define environment variable
ENV NAME __main__
ENV FLASK_APP app/app.py
ENV FLASK_RUN_HOST 0.0.0.0
ENV GOOGLE_APPLICATION_CREDENTIALS ./resources/google/credentials.json
ENV GOOGLE_CLOUD_BUCKET_NAME bucket_name

# Run app.py when the container launches
CMD ["flask", "run"]

SSH密鑰作為參數傳遞給$(cat ./ssh/id_rsa)

Answer 1

您不希望以這種方式傳遞SSH密鑰：它將最終出現在生成的映像中，因此有權訪問該映像的任何人都可以訪問您的SSH密鑰。

選項：

1. 使用BuildKit，它具有內置的SSH代理轉發（ https://docs.docker.com/develop/develop-images/build_enhancements/#using-ssh-to-access-private-data-in-builds ）。
2. 我在這里描述的技術太復雜，無法涵蓋簡短的答案： https : //pythonspeed.com/articles/docker-build-secrets/
3. 如果您不擔心泄漏私人SSH密鑰，請修復此設置。 我的猜測是您還需要chmod 700 /root/.ssh 。