在DigitalOcean应用平台用Docker部署Payload CMS无法读取密钥环境变量

问题概况 #

在DigitalOcean应用平台部署Payload CMS基础模板时，构建失败，报错提示：a secret key is needed to secure payload。明明已经在应用的环境变量配置区设置了PAYLOAD_SECRET，而且构建日志也显示加载了该变量和数据库连接信息：

configuring build-time app environment variables:
DATABASE_URI PAYLOAD_SECRET 

但Docker构建过程就是读不到这个变量，使用的Dockerfile如下：

FROM node:18.8-alpine as base

FROM base as builder

WORKDIR /home/node/app
COPY package*.json ./

COPY . .
RUN yarn install
RUN yarn build

FROM base as runtime

ENV NODE_ENV=production
ENV PAYLOAD_CONFIG_PATH=dist/payload.config.js

WORKDIR /home/node/app
COPY package*.json  ./
COPY yarn.lock ./

RUN yarn install --production
COPY --from=builder /home/node/app/dist ./dist
COPY --from=builder /home/node/app/build ./build

EXPOSE 3000

CMD ["node", "dist/server.js"]

问题原因 #

Payload CMS在执行yarn build（也就是Dockerfile里的builder阶段）时，需要读取PAYLOAD_SECRET来完成构建操作。但当前的Dockerfile没有在builder阶段接收并传递这个环境变量，即便DigitalOcean显示加载了构建时变量，也没注入到builder容器里。

解决办法 #

方法1：修改Dockerfile传递构建时变量 #

在Dockerfile的builder阶段添加ARG指令接收构建时的环境变量，再转成容器内的环境变量，让yarn build能读到：

FROM node:18.8-alpine as base

FROM base as builder

# 声明要接收的构建时环境变量
ARG PAYLOAD_SECRET
ARG DATABASE_URI

# 把ARG转为容器环境变量，供build过程使用
ENV PAYLOAD_SECRET=$PAYLOAD_SECRET
ENV DATABASE_URI=$DATABASE_URI

WORKDIR /home/node/app
COPY package*.json ./

COPY . .
RUN yarn install
RUN yarn build

FROM base as runtime

ENV NODE_ENV=production
ENV PAYLOAD_CONFIG_PATH=dist/payload.config.js

WORKDIR /home/node/app
COPY package*.json  ./
COPY yarn.lock ./

RUN yarn install --production
COPY --from=builder /home/node/app/dist ./dist
COPY --from=builder /home/node/app/build ./build

EXPOSE 3000

CMD ["node", "dist/server.js"]

方法2：确认DigitalOcean环境变量类型 #

DigitalOcean的环境变量分构建时和运行时两种，要确保PAYLOAD_SECRET和DATABASE_URI被设置为构建时变量——配置的时候记得勾选"Apply at build time"选项。如果之前设成了运行时变量，构建阶段肯定读不到。

验证 #

修改完之后重新部署应用，查看构建日志，确认yarn build阶段能正常读取PAYLOAD_SECRET，构建就能成功完成了。

内容的提问来源于stack exchange，提问作者newBieDev