Defining extra build arguments for web/db images

[mrneatly]

I looked through entire documentation, but could not find an answer to this: is there a way to define custom build arguments for web or db images, so they would appear in .ddev-docker-compose-full.yaml? If yes, then what is the proper way of doing that?

[rfay]

Can you please say what you are trying to accomplish?

You could do it with a docker.compose.*.yaml. https://ddev.readthedocs.io/en/latest/users/extend/custom-compose-files/

[mrneatly]

I'm trying to pass some values from .env file to a Dockerfile as arguments so I could use them during the building process.

[rfay]

Can you please say what you're trying to accomplish. What are you doing with your .ddev/web-build/Dockerfile and why does it need extra args? (I'm not sure whether you can use args from a .env this way, but I'm sure you'll find out.)

So you would in your docker-compose.args.yaml:

services:
  web:
    build:
      args:
        something: 'xxx'
        somethingelse: 'yyy'

And you'e experiment with using your env vars there.

[mrneatly]

I need to pass a few private credentials to Dockerfile from .env file in order to build a web image. The only way that works for sure is passing them via args, but there aren't any examples of adding extra args to a web image (or I just haven't looked well enough). I am aware of web_environment directive, but as much as I know there is no way to use env-variables during image building process. Is there a way to do it more conveniently, or am I doing it wrong?

[rfay]

Normally, putting private credentials into an image is a really bad idea from a security perspective. Why do they go into the image? I'm still hoping for a concrete statement from you about the problem you're trying to solve.

[mrneatly]

In our team, docker images are built only for development environment and are not shared across any public network, so I don't really see any significant security flaw here. I don't state this is the correct way of doing things though, so I'll be happy if you share some hints towards the better approaches of achieving this.

In my particular case, I'm configuring a composer's access to Bitbucket and a connection to NPM registry:

RUN composer config --global bitbucket-oauth.bitbucket.org $BITBUCKET_KEY $BITBUCKET_SECRET
RUN echo "//registry.npmjs.org/:_authToken=$NPM_AUTH_TOKEN" >> /root/.npmrc

I'm also configuring timezone with
RUN ln -snf /usr/share/zoneinfo/$APP_TIMEZONE /etc/localtime && echo $APP_TIMEZONE > /etc/timezone
but I agree this could be done with timezone directive in config.yaml instead.

With that being said, how can I improve here?

[rfay]

The normal (and far easier) way to provide those secrets would be in the global homeadditions, as described in https://ddev.readthedocs.io/en/latest/users/extend/in-container-configuration/

And yes, the config.yaml timezone is the place to set the timezone.

[mrneatly]

Superb, will try this out!

[mrneatly]

It's been a while, but it seems that this approach did the trick. Once again, thank you for your help!