CodeBuild中含额外凭证的Docker构建阶段失败排查

问题背景 #

在AWS CodeBuild中执行Docker构建时，携带--secret参数传递AWS凭证失败，移除该参数的基础构建流程可正常运行。

提供的buildspec.yml #

version: 0.2

phases:
  pre_build:
    commands:
      - echo Logging in to Amazon ECR...
      - aws --version
      - aws ecr get-login-password --region us-west-2 | docker login --username AWS --password-stdin XXXXXXXXXXXX.dkr.ecr.us-west-2.amazonaws.com
      - REPOSITORY_URI=XXXXXXXXXXXX.dkr.ecr.us-west-2.amazonaws.com/wp-api
      - COMMIT_HASH=$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | cut -c 1-7)
      - IMAGE_TAG=build-$(echo $CODEBUILD_BUILD_ID | awk -F":" '{print $2}')
  build:
    commands:
      - echo Build started on `date`
      - echo Building the Docker image...
      - docker build -t app:latest --secret id=awscredentials,src=$HOME/.aws/credentials .
      - docker tag app:latest REPOSITORY_URI:latest
  post_build:
    commands:
      - echo Build completed on `date`
      - echo Pushing the Docker images...
      - docker push $REPOSITORY_URI:latest

错误日志 #

[Container] 2022/07/11 18:37:24 Command did not exit successfully docker build -t app:latest --secret id=awscredentials,src=$HOME/.aws/credentials . exit status 1
[Container] 2022/07/11 18:37:24 Phase complete: BUILD State: FAILED
[Container] 2022/07/11 18:37:24 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: docker build -t app:latest --secret id=awscredentials,src=$HOME/.aws/credentials .. Reason: exit status 1
[Container] 2022/07/11 18:37:24 Entering phase POST_BUILD
[Container] 2022/07/11 18:37:24 Running command echo Build completed on `date`
Build completed on Mon Jul 11 18:37:24 UTC 2022

修复方案 #

1. 启用Docker BuildKit支持 #

--secret参数依赖Docker BuildKit特性，CodeBuild默认环境可能未启用。可在build命令前添加环境变量：

- DOCKER_BUILDKIT=1 docker build -t app:latest --secret id=awscredentials,src=$HOME/.aws/credentials .

或在buildspec顶部全局配置：

env:
  variables:
    DOCKER_BUILDKIT: 1

2. 确保凭证文件存在且权限正确 #

CodeBuild环境中默认没有$HOME/.aws/credentials文件，需手动生成。在pre_build阶段添加以下命令：

- mkdir -p $HOME/.aws
- echo "[default]" > $HOME/.aws/credentials
- echo "aws_access_key_id=$AWS_ACCESS_KEY_ID" >> $HOME/.aws/credentials
- echo "aws_secret_access_key=$AWS_SECRET_ACCESS_KEY" >> $HOME/.aws/credentials
- chmod 600 $HOME/.aws/credentials

3. 修正Dockerfile中的Secret引用 #

检查Dockerfile是否正确挂载secret，示例如下（根据实际场景调整）：

RUN --mount=type=secret,id=awscredentials,target=/root/.aws/credentials \
    # 此处添加需要使用凭证的业务命令，比如安装私有依赖
    pip install -r requirements.txt

4. 修复tag命令的变量引用错误 #

原build阶段的tag命令未使用$引用变量，会导致镜像tag失败：

# 原错误命令
- docker tag app:latest REPOSITORY_URI:latest
# 修正后
- docker tag app:latest $REPOSITORY_URI:latest

内容的提问来源于stack exchange，提问作者acciolurker