Maintaining build secrets in a build container

Patent metadata

Field	Value
Publication number	US-10162627-B2
Application number	US-201615056365-A
Country	US
Kind code	B2
Filing date	Feb 29, 2016
Priority date	Feb 29, 2016
Publication date	Dec 25, 2018
Grant date	Dec 25, 2018

Abstract

Implementations provide for a container-based architecture that can maintain build secrets. A method of the disclosure includes storing a file in a destination directory of a build container. The file includes authentication data to retrieve information from a repository. A build of an application image is initiated at a build container. The application image is built using the information retrieved from the repository via the loaded file. In response to receiving an indication that the build of the application imaged is complete, the loaded file is truncated.

First claim

What is claimed is:

1. A method comprising:
receiving, by a processing device executing build secret logic, a configuration file to utilize to obtain source code for building an application image for an application, the configuration file comprising authentication data to securely connect to a repository comprising the source code and information corresponding to the application;
initiating, by the processing device, a build container to build the application image;
determining, by the build secret logic executed by the processing device, a destination directory of the build container to store the configuration file;
storing, by the build secret logic of the processing device, the configuration file in the destination directory of the build container, wherein the build secret logic to provide a name for the configuration file to identify the configuration file as comprising a build secret;
initiating, by the processing device, a build of the application image at the build container;
executing, by the build secret logic, a wrapper script in association with the build container;
building, by the processing device via the wrapper script and the build container, the application image for an application using the source code and the information retrieved from the repository via the stored configuration file;
identifying, by the wrapper script, a last file of the application image using an identifier of the last file; and
in response to the wrapper script identifying the last file of the application image and prior to deploying the application image, truncating, by the wrapper script as part of the build of the application image, the stored configuration file.

2. The method of claim 1 , further comprising retrieving from the repository, by the processing device via the stored configuration file prior to completion of the build of the application image, the information comprising an additional dependency to perform the build of the application image.

3. The method of claim 2 , further comprising overwriting an existing dependency in the application image with the additional dependency.

4. The method of claim 1 , wherein the truncating the stored configuration file comprises converting a length of the stored file to a zero bit length.

5. The method of claim 1 , further comprising:
committing the application image to a committed application image repository, wherein the image does not include the authentication data.

6. The method of claim 1 , wherein the application image is associated with files of the application used to deploy functionality for a runtime instance of the application.

7. The method of claim 1 , wherein the repository is a private repository and wherein the stored configuration file further comprises a uniform resource locator providing a location to the private repository.

8. The method of claim 1 , further comprising generating, by the processing device, the name for the stored configuration file identifying the stored configuration file as a configuration file.

9. The method of claim 1 , wherein the stored configuration file is truncated via the wrapper script in response to creating the last file of the application image.

10. The method of claim 1 , further comprising creating the destination directory in the build container.

11. A system comprising:
a memory; and
a processing device of a container-based system, the processing device communicably coupled to the memory, the processing device to:
execute build secret logic for a build of an application image of an application;
receive, via the build secret logic, a configuration file for obtaining source code for the build, the configuration file comprising authentication data to securely connect to a repository comprising the source code and information corresponding to the application;
initiate a build container to build the application image;
determine, via the build secret logic, a destination directory of the build container to store the configuration file;
store, using the build secret logic, the configuration file in the destination directory of the build container, wherein the build secret logic to provide a name for the configuration file to identify the configuration file as comprising a build secret;
initiate a build of the application image at the build container;
provide authentication credentials extracted from the stored configuration file to access a repository;
retrieve the information and the source code from the repository;
execute, by the build secret logic, a wrapper script in association with the build container;
build the application image, via the wrapper script and the build container, in view of the source code and the information retrieved from the repository via the stored configuration file;
identify, by the wrapper script, a last file of the application image using an identifier of the last file; and
in response to the wrapper script identifying the last file of the application image and prior to deploying the application image, truncate, by the wrapper script, the stored configuration file as part of the build of the application image via the build container.

12. The system of claim 11 , wherein a permission of the stored configuration file comprises write access.

13. The system of claim 11 , wherein to truncate the stored configuration file the processing device is further to convert a length of the stored configuration file to a zero bit length.

14. The system of claim 11 , wherein the repository is located remotely from the processing device.

15. The system of claim 11 , wherein the repository is a private repository and wherein the stored configuration file further comprises a uniform resource locator providing a location to the private repository.

16. The system of claim 11 , wherein the container-based system is a multi-tenant platform-as-a-service (PaaS) system.

17. A non-transitory machine-readable storage medium including instructions that, when accessed by a processing device, cause the processing device to:
receive, by the processing device executing build secret logic, a configuration file to utilize to obtain source code for building an application image for an application, the configuration file comprising authentication data to securely connect to a repository comprising the source code and information corresponding to the application;
initiate, by the processing device, a build container to build the application image;
determine, by the build secret logic executed by the processing device, a destination directory of the build container to store the configuration file;
store, by the build secret logic of the processing device, the configuration file in the destination directory of the build container, wherein the build secret logic to provide a name for the configuration file to identify the configuration file as comprising a build secret;
initiate, by the processing device, a build of the application image at the build container;
execute, by the build secret logic, a wrapper script in association with the build container;
build, by the processing device via the wrapper script and the build container, the application image for an application using the source code and the information retrieved from the repository via the stored configuration file;
identify, by the wrapper script, a last file of the application image using an identifier of the last file; and
in response to the wrapper script identifying the last file of the application image and prior to deploying the application image, truncate, by the wrapper script as part of the bu

Assignees

• Red Hat Inc

Inventors

• Fojtik Michal
• Semushin Vyacheslav

Classifications

• G06F9/44505

  Configuring for program initiating, e.g. using registry, configuration files · CPC title

• G06F8/71 Primary

  Version control (security arrangements therefor G06F21/57); Configuration management · CPC title