6

This is actually a question following from my previous one.

I am trying to use docker to host a personal note-taking web service and want to backup data generated by the service (my notes). Currently I plan to use git to commit, pull, and push to a repository for my purpose.

To do git pull and push, my docker image needs to host my credentials. What is the easiest yet safe way to achieve this?

What I have done so far:

  • I choose Alpine as the base image of the image of my service.
  • Because I only need credentials for git, I think put a git credential helper into the image may solve my problem. I can save credentials to the helper during the build time and use them during runtime.
  • I googled a while and decided to use libsecret as my git credential helper, according to this article.
  • I have installed libsecret and set my git credential helper to be git-credential-libsecret

However, I cannot make git-credential-libsecret functional so far. Here are a couple of problems that I encountered:

  • Firstly, I tested git-credential-libsecret get and get the following error:

    CRITICAL **: could not connect to Secret Service: Cannot spawn a message bus without a machine-id: Unable to load /var/lib/dbus/machine-id or /etc/machine-id: Failed to open file */var/lib/dbus/machine-id*: No such file or directory

    • I (probably?) solved it by installing dbus and run dbus-uuidgen > /var/lib/dbus/machine-id

  • Then I try to run git-credential-libsecret get again. This time, it reports that:

    CRITICAL **: could not connect to Secret Service: Cannot autolaunch D-Bus without X11 $DISPLAY

    • I tried to install dbus-x11 and run dbus-launch --sh-syntax(from here) but with no luck this time. The error continues.

In conclusion, I would like to know:

  1. Am I on a right direction (using git credential helper) to achieve my goal?
  2. If so, how can I resolve the X11 problem?
  3. Are there any other quick and clean methods to backup data in docker with version control?
YAC
  • 405
  • 4
  • 14
  • also, why you could not use [git-credential-store](https://git-scm.com/docs/git-credential-store)? It does not seem to use X11 dbus or whatever – max630 Jan 13 '18 at 07:51
  • 1
    People spend time answering your questions. In return, you should mark an answer for your previous questions and +1 for good comments. – Bernard Jan 13 '18 at 08:14
  • @max630 I chose not to use git-credential-store because it saves password in plain text. But maybe I am just being paranoid. – YAC Jan 13 '18 at 09:30
  • 1
    I don't know much about libsecret, but it seems to be some kind of password manager which can encrypt the password with master password which user can enter interactively to decrypt the password. But since you are going to run it non-interactively, the image would anyway have to contain the password, maybe somehow obfuscated. – max630 Jan 13 '18 at 10:54
  • Yeah, I think you're probably right. No matter how the serialized passwords are encrypted by credential helper, when a bad guy somehow has the full control over my container, s/he can retrieve passwords simply through the credential helper interface (because the credential helper thinks the bad guy is authenticated). I did not think about that before. – YAC Jan 13 '18 at 11:13

3 Answers3

3

If your git provider supports ssh with public keys, I think the easiest way would be to switch to them. You would also not have to copy around your password.

You need to:

max630
  • 8,762
  • 3
  • 30
  • 55
  • In your opinion, which is safer or causes less damage to my overall privacy when leaked? Placing an SSH private key in image V.S. using git-credential-store to save plain text accout-password pair in image. – YAC Jan 13 '18 at 11:39
1

It depends on where you are running git-credential-libsecret: you need to have it installed in your image/container, not on the host.

Note that another option would be to use a volume (see my answer to your previous question), in which case, git could be installed only on the host.

But here, you would use git directly in your image, which means, as in this Dockerfile, you need to have in your Dockerfile:

RUN apt-get update -y &&
apt-get install --no-install-recommends -y libsecret-1-0 git

https://github.com/electron-userland/electron-builder/blob/master/docker/base/Dockerfile

VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
  • Yes I did install and ran git-credential-libsecret in my Alpine image. (And it did take me a while to get it compiled.) This is why I am so troubled by the X11 issue as I don't think it is possible to run X11 in my image. – YAC Jan 13 '18 at 09:37
  • Maybe there is a compilation option which would specify to not use any way x11 dependency? – VonC Jan 13 '18 at 09:39
  • That is a good point. However, I cannot see any options in its Makefile. I am not quite sure what is the role of libsecret. I saw from somewhere that it is a interface for accessing secret service. On Alpine, it seems to be `secret-tool`. And running `secret-tool` also gets the X11 error. – YAC Jan 13 '18 at 09:49
  • You can also use a `.netrc`, which is supported by Git (via curl) with no dependencies. – Edward Thomson Jan 13 '18 at 11:31
0

I solved this problem by doing:

# syntax=docker/dockerfile:1

FROM alpine:latest
RUN apk update
RUN apk add git
RUN --mount=type=secret,id=git_credential_store \
  git clone "https://me:$(cat /run/secrets/git_credential_store | sed 's/.*\/\/\(.*\):.*/\1/')@github.com/me/app-repo.git"

and supply the secret like this:

docker build --secret id=git_credential_store,src=/path/to/.git-credential-store -t my-amazing-image
patrick
  • 9,290
  • 13
  • 61
  • 112