VirusTotalNet
VirusTotalNet copied to clipboard
Copy private NPM credentials if exists
Description
Motivation and Context
Some projects have dependencies in private NPM registries. Currently, faas-cli build
will release an incomplete image which dependency errors in production.
This change will copy a .npmrc
containing the NPM registry auth token, if it is present.
- [x] I have raised an issue to propose this change (required)
Which issue(s) this PR fixes
Fixes #103
Thank you for your contribution. I've just checked and your commit doesn't appear to be signed-off. That's something we need before your Pull Request can be merged. Please see our contributing guide.
Hi @feynmanliang thanks for your interest in the project.
I see you're having a bit of trouble with the bot and sign-off process. You'd be better off resetting all those commits and then adding your change on the top of master.
I am not sure this is a good change though since this could lead to leaking private npm credentials within your Docker image. cc @padiazg @pyramation
Maybe you could pass it via a build-arg or similar?
Alex
Great idea and thanks for helping out! However, this is honestly a bad security practice to put in the main repo IMHO. Not secure. The pattern I use that works today using Dockerfile is this:
place a .npmrc
locally
contents of .npmrc
:
//registry.npmjs.org/:_authToken=${NPM_TOKEN}
edit your Dockerfile
to use ARG
:
ARG NPM_TOKEN
COPY .npmrc .npmrc
ENV NODE_ENV production
RUN npm install -g @yourNpmAccount/[email protected]
RUN rm .npmrc
- Notice it removes the
.npmrc
!
build image
Then make sure you have NPM_TOKEN
in your env, and run
faas build -f production-stack.yml --build-arg NPM_TOKEN=${NPM_TOKEN}
Thanks for catching that security flaw; that would have been bad >.<
I will revise this to accept a build arg.
Not 100% sure if copying .npmrc
will work (Docker might complain if none of the files in a COPY command exist) but will test it out shortly.
Yes @feynmanliang looks like it does error out:
COPY failed: stat /var/lib/docker/tmp/docker-builder325671983/function/.npmrc: no such file or directory
https://travis-ci.org/openfaas/templates/builds/469855203#L1348