Injecting service account json as part of docker build

user_4662624 0
Viewed 141

As part of the build process, I need to download some python packages from my private gcs bucket and install them as part of the Dockerfile. This could be done using a multi-stage builds like this one:

FROM google/cloud-sdk:alpine as gcloud
WORKDIR /packages
RUN gsutil cp gs://... /packages

FROM python:3.7.0
COPY --from=gcloud /packages .

but I have big problem with injecting service account from my local machine so that gsutil will be able to perform copy. I tried capturing content of service account json via ARG but it does not work with cloudbuild substitutions due to its json format:

gcloud builds submit . --substitutions _SERVICE_ACCOUNT_CONTENT="$(cat path_to_service_account.json)"

I also though about shared volumes between steps but it does not work with docker build. Any ideas how can I do this with cloudbuild?

google-cloud-build
1 Answers

My recommendation is to do this outside your Docker Build, and to leverage the Cloud Build built in authentication mechanism (through metadata server) to download the files.

In your cloud build steps


steps:
  - name: 'gcr.io/cloud-builders/gsutil'
    args: ["cp", "gs://...", "./packages"]
  - name: 'gcr.io/cloud-builders/docker'
    args: [ 'build', '-t', 'gcr.io/<PROJECT_ID>/......', '.' ]

In your Dockerfile

FROM python:3.7.0
COPY packages/* /packages/
.....

Simply grant the Cloud Build service account to have access to your bucket.

user_113725930
Related