构建Mozilla SOPS+Age加密Docker容器时脚本执行失败求助

我正在开发一个集成Age加密的Mozilla SOPS Docker容器，执行docker-compose up构建到RUN /app/config/generate_sops_config.sh步骤时报错。相关配置文件如下：

./Dockerfile:

FROM alpine:latest

# Install sops
RUN wget https://github.com/mozilla/sops/releases/download/v3.8.1/sops-v3.8.1.linux.amd64 -O /usr/local/bin/sops \
    && chmod +x /usr/local/bin/sops 

# Install age
RUN wget https://github.com/FiloSottile/age/releases/download/v1.1.1/age-v1.1.1-linux-amd64.tar.gz -O /usr/local/bin/age \
    && chmod +x /usr/local/bin/age

RUN export PATH=/usr/local/bin:${PATH}

# Copy the script to generate_sops_config.sh
COPY ./src/generate_sops_config.sh /app/config/generate_sops_config.sh
RUN chmod +x /app/config/generate_sops_config.sh

# Execute the script to generate .sops.yaml and private keys
RUN /app/config/generate_sops_config.sh
RUN chmod 600 /app/config/.sops.yaml

# Cleanup
RUN rm -f /app/config/generate_sops_config.sh

ENTRYPOINT [\"sops\"]

./generate_sops_config.sh:

#!/bin/bash

# Generate age key pair
age-keygen -o age_key.dev.txt
age-keygen -o age_key.prod.txt

# Extract the public key
prod_age_pubkey=$(cat age_key.dev.txt.pub)
prod_age_pubkey=$(cat age_key.prod.txt.pub)

# Update .sops.yaml with the public key
cat <<EOF > .sops.yaml
creation_rules:
  - path_regex: \.dev\.yaml$
    age: |
      -----BEGIN AGE ENCRYPTED FILE-----
      ${dev_age_pubkey}
      -----END AGE ENCRYPTED FILE-----

  - path_regex: \.prod\.yaml$
    age: |
      -----BEGIN AGE ENCRYPTED FILE-----
      ${prod_age_pubkey}
      -----END AGE ENCRYPTED FILE-----
EOF

./docker-compose.yml:

version: '3'

services:
  sops-service:
    build:
        context: .
    volumes:
      - ./shared:/app/shared/
      - ./config:/app/config/

排查出的核心问题 #

• Age安装逻辑错误：直接将tar.gz压缩包保存为/usr/local/bin/age，未解压出可执行文件，导致age-keygen命令无法执行
• 脚本变量赋值错误：把dev环境公钥错误赋值给prod变量，且dev_age_pubkey未定义，生成.sops.yaml时会出现空值
• 文件生成路径错误：脚本执行时默认在根目录生成文件，后续步骤无法在/app/config找到.sops.yaml
• PATH环境变量未持久化：export PATH仅在当前RUN层生效，后续执行脚本时无法识别age命令
• ENTRYPOINT语法错误：转义引号[\"sops\"]会导致容器启动失败

修正后的配置文件 #

./Dockerfile #

FROM alpine:latest

# 安装依赖工具
RUN apk add --no-cache wget tar

# 安装sops
RUN wget https://github.com/mozilla/sops/releases/download/v3.8.1/sops-v3.8.1.linux.amd64 -O /usr/local/bin/sops \
    && chmod +x /usr/local/bin/sops 

# 正确解压安装age
RUN wget https://github.com/FiloSottile/age/releases/download/v1.1.1/age-v1.1.1-linux-amd64.tar.gz -O /tmp/age.tar.gz \
    && tar -xzf /tmp/age.tar.gz -C /tmp \
    && mv /tmp/age/age /usr/local/bin/age \
    && mv /tmp/age/age-keygen /usr/local/bin/age-keygen \
    && chmod +x /usr/local/bin/age /usr/local/bin/age-keygen \
    && rm -rf /tmp/age*

# 持久化环境变量
ENV PATH=/usr/local/bin:${PATH}

# 创建目标目录避免COPY失败
RUN mkdir -p /app/config

# 复制脚本并赋予执行权限
COPY ./src/generate_sops_config.sh /app/config/generate_sops_config.sh
RUN chmod +x /app/config/generate_sops_config.sh

# 切换到目标目录执行脚本，确保文件生成在正确路径
WORKDIR /app/config
RUN ./generate_sops_config.sh
RUN chmod 600 .sops.yaml

# 清理脚本
RUN rm -f generate_sops_config.sh

ENTRYPOINT ["sops"]

./generate_sops_config.sh #

#!/bin/bash

# 生成age密钥对
age-keygen -o age_key.dev.txt
age-keygen -o age_key.prod.txt

# 正确提取公钥
dev_age_pubkey=$(cat age_key.dev.txt.pub)
prod_age_pubkey=$(cat age_key.prod.txt.pub)

# 生成.sops配置文件（当前目录为/app/config）
cat <<EOF > .sops.yaml
creation_rules:
  - path_regex: \.dev\.yaml$
    age: "${dev_age_pubkey}"
  - path_regex: \.prod\.yaml$
    age: "${prod_age_pubkey}"
EOF

./docker-compose.yml #

version: '3'

services:
  sops-service:
    build:
        context: .
    volumes:
      - ./shared:/app/shared/
      - ./config:/app/config/

额外注意事项 #

1. 确保generate_sops_config.sh存放在./src目录（与Dockerfile的COPY路径对应）
2. 构建前清理缓存：docker-compose down && docker rmi sops-service_sops-service
3. 执行docker-compose up --build强制重新构建

内容的提问来源于stack exchange，提问作者MrChadMWood