How to Build Go Apps with Private GitLab Modules in Docker using SSH?

Building Go Apps with Private GitLab Modules in Docker

This guide aims to address the specific challenges faced when integrating private GitLab modules into Go applications within Docker.

Understanding the Issue

The issue arises when a Dockerfile attempts to pull private packages from GitLab, but authentication fails despite following similar tutorials forGitHub. This specific problem stems from the differences between GitHub and GitLab's authentication mechanisms.

Proposed Solution

To resolve this issue, we will utilize SSH-based authentication and employ Docker's experimental features.

Experimental Docker Features

Enable experimental Docker features by adding the following comment at the beginning of your Dockerfile:

# syntax=docker/dockerfile:experimental

Dockerfile Setup

1. Ensure your build environment has openssh-client:

RUN apk --no-cache add build-base git mercurial gcc curl openssh-client

2. Establish known_hosts and configure .gitconfig:

RUN mkdir -p -m 0700 ~/.ssh && \
    ssh-keyscan gitlab.com >> ~/.ssh/known_hosts && \
    echo -e "[url \"[email&#160;protected]:<company-name>\"]\n\tinsteadOf = https://gitlab.com/<company-name>\"" >> ~/.gitconfig

3. Build your Go application with SSH-based authentication:

ENV GO111MODULE=on
ENV GOPRIVATE=gitlab.com/<company-name>
RUN --mount=type=ssh cd cmd/app/ &amp;&amp; go build -o app

Load Key in ssh-agent

Before building the Docker image, the private key must be loaded into the ssh-agent:

ssh-add id_rsa

Building the Docker Image

Build the Docker image using the following command:

DOCKER_BUILDKIT=1 docker build --progress=plain .

Debugging SSH Connection

If SSH connection problems arise, add the following debug command to your Dockerfile:

RUN ssh -A -v -l git gitlab.com

Resolving the AppArmor Issue

If apparmor is blocking Docker's access to the SSH key socket, edit the apparmor profile and add the following line before the closing }:

/run/user/1000/keyring/ssh rw,

Key Filename Issue

Ensure that the private key filename is one of the default values that SSH expects (e.g., id_rsa) or use the .ssh/config file to map a custom key name to the expected default.

Additional Notes

Avoid using chmod to grant permissions, as the SSH key entry is sufficient for sharing the private key. It is also recommended to avoid using .netrc as it embeds credentials into the Docker image, potentially compromising security.

The above is the detailed content of How to Build Go Apps with Private GitLab Modules in Docker using SSH?. For more information, please follow other related articles on the PHP Chinese website!