Cloud Build构建Docker镜像失败：提示'docker build'需1个参数

通过Cloud Build触发器结合Secret Manager密钥构建Cloud Run任务时，构建流程触发成功但执行失败，报错信息如下：

BUILD
Starting Step #0 - "build image"
Step #0 - "build image": Already have image (with digest): gcr.io/cloud-builders/docker
Step #0 - "build image": "docker build" requires exactly 1 argument.
Step #0 - "build image": See 'docker build --help'.
Step #0 - "build image": 
Step #0 - "build image": Usage:  docker build [OPTIONS] PATH | URL | -
Step #0 - "build image": 
Step #0 - "build image": Build an image from a Dockerfile
Finished Step #0 - "build image"
ERROR
ERROR: build step 0 "gcr.io/cloud-builders/docker" failed: step exited with non-zero status: 1

已尝试的操作：

• 验证命令中包含构建目录
• 调整构建参数的顺序
• 尝试使用breakout语法（以'|'作为参数之一），但镜像完全未构建
• 更新：移除--build-arg参数后，构建可正常运行，疑似该参数存在问题

以下是cloudbuild.yaml配置：

steps:
  - id: "build image"
    name: "gcr.io/cloud-builders/docker"
    entrypoint: 'bash'
    args:
      ['-c', 'docker build --build-arg CONTAINER_PRIVATE_KEY=$$PRIVATE_KEY --build-arg CONTAINER_PUBLIC_KEY=$$PUBLIC_KEY -t gcr.io/${PROJECT_ID}/${_JOB_NAME} .']
    secretEnv: [ 'PRIVATE_KEY', 'PUBLIC_KEY' ]
  - id: "push image"
    name: "gcr.io/cloud-builders/docker"
    args: [ "push", "gcr.io/${PROJECT_ID}/${_JOB_NAME}" ]

  - id: "deploy to cloud run"
    name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    entrypoint: gcloud
    args:
            [
              'beta', 'run', '${_JOB_NAME}',
              '--image', 'gcr.io/${PROJECT_ID}/${_JOB_NAME}',
              '--region', '${_REGION}',
              '--set-env-vars', "BUCKET=${_BUCKET}",
              '--set-env-vars', "MNT_DIR=${_MNT_DIR}"
            ]
images:
    - "gcr.io/${PROJECT_ID}/${_JOB_NAME}"
availableSecrets:
  secretManager:
    - versionName: "projects/${_PROJECT_ID_NUMBER}/secrets/${_CONTAINER_PRIVATE_KEY_SECRET_NAME}/versions/latest"
      env: "PRIVATE_KEY"
    - versionName: "projects/${_PROJECT_ID_NUMBER}/secrets/${_CONTAINER_PUBLIC_KEY_SECRET_NAME}/versions/latest"
      env: "PUBLIC_KEY"

问题根源是密钥值包含空格、换行或特殊字符，直接在docker build命令中传递未加引号的构建参数时，bash会将这些特殊字符解析为命令分隔符，导致docker build命令被拆分，丢失最后的构建目录参数（.），从而触发"requires exactly 1 argument"错误。

修改方法是给--build-arg的参数值加上单引号，确保bash将其作为整体解析：

steps:
  - id: "build image"
    name: "gcr.io/cloud-builders/docker"
    entrypoint: 'bash'
    args:
      ['-c', 'docker build --build-arg CONTAINER_PRIVATE_KEY=''$$PRIVATE_KEY'' --build-arg CONTAINER_PUBLIC_KEY=''$$PUBLIC_KEY'' -t gcr.io/${PROJECT_ID}/${_JOB_NAME} .']
    secretEnv: [ 'PRIVATE_KEY', 'PUBLIC_KEY' ]
  # 其他步骤保持不变

也可以改用双引号包裹整个docker build命令（注意转义内部的双引号）：

steps:
  - id: "build image"
    name: "gcr.io/cloud-builders/docker"
    entrypoint: 'bash'
    args:
      ['-c', "docker build --build-arg CONTAINER_PRIVATE_KEY=\"$$PRIVATE_KEY\" --build-arg CONTAINER_PUBLIC_KEY=\"$$PUBLIC_KEY\" -t gcr.io/${PROJECT_ID}/${_JOB_NAME} ."]
    secretEnv: [ 'PRIVATE_KEY', 'PUBLIC_KEY' ]

原理说明 #

当密钥包含特殊字符时，未加引号的参数会被bash分割成多个独立部分，导致docker build接收到的参数结构混乱，无法识别最后的构建目录。通过给参数值添加引号，强制bash将整个密钥值作为单个参数传递，确保命令结构完整，能正确执行构建操作。

内容的提问来源于stack exchange，提问作者vadim_v