We use a Docker in Docker (dind) image for our GitHub runners so teams can build their applications.

Before having authentication in our repositories, something like this worked:

FROM library/python:3.0.0
RUN apt update && apt install -y build-essential && rm -rf /var/lib/apt/lists/*
WORKDIR /home/appuser
COPY ./requirements.txt requirements.txt
RUN pip install --no-cache-dir --prefer-binary ---r requirements.txt

where requirements.txt included public and in-house artifacts, only available in our repositories.

Now, we need to add the credentials to the build process (only) so credentials are not in the final image. We want to do it in the least disruptive way with, if possible, no changes to any existing Dockerfile but only into the build command.

This is the best we achieved:

FROM library/python:3.0.0
RUN apt update && apt install -y build-essential && rm -rf /var/lib/apt/lists/*
WORKDIR /home/appuser
COPY ./requirements.txt requirements.txt
RUN --mount=type=secret,id=pipconf,target=/etc/pip.conf pip install --no-cache-dir --prefer-binary -r requirements.txt

The docker build command ends up looking like this:

docker build --no-cache --force-rm --progress=plain --secret id=pipconf,type=file,src=/home/runner/python/pip/pip.conf --build-arg PIP_CONFIG_FILE=/run/secrets/pipconf . -t test-sebas:0.0.1 

So in total, we need to change the build command (we control that part with custom actions used by the teams), but we still need to “mount” the secret so it is used during build.

Is there any way we can avoid having to request all teams to change their Dockerfiles, considering we own the actions they use, including control over the docker build command and its arguments and also over the runners using dind images.