Repository navigation
fix: Dockerfile .env COPY failure blocking v0.6.2 image build - #91
Merged
Merged
Conversation
…드 실패 수정 Dockerfile.mciammanager의 COPY .env /app/.env, COPY .env /.env가 빌드 컨텍스트의 .env를 이미지에 구워 넣고 있었다. IAM-BUG-009로 .env가 git에서 untrack되며 CI 체크아웃엔 .env가 없어 이 COPY가 "/.env": not found로 항상 실패 — v0.6.2 태그/main push CD가 모두 이미지 빌드 단계에서 죽었다. COPY 대상을 git에 남아있는 템플릿 .env.setup으로 교체한다(두 경로 모두 유지). godotenv.Load()는 이미 설정된 OS 환경변수를 덮어쓰지 않으므로(joho/godotenv v1.5.1 loadFile: `!currentEnv[key] || overload`, overload=false) docker-compose env_file/environment로 주입된 실제 값이 항상 우선하고, 이 템플릿은 값이 없을 때의 fallback으로만 쓰인다. 로컬 docker build -f Dockerfile.mciammanager --target prod로 빌드 성공 확인 + 컨테이너 내부에서 /app/.env, /.env 존재 확인.
fix(docker): .env COPY를 .env.setup 기반 fallback으로 교체 — v0.6.2 CD 이미지 빌드 실패 수정
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixed
v0.6.2 CD pipeline failure:
Dockerfile.mciammanager's runtime stage hadCOPY .env /app/.env/COPY .env /.env, baking the build context's.envinto the image. #152 (IAM-BUG-009, included in v0.6.2) untracked.envfrom git, so CI's checkout no longer has a.envfile and the image build failed with"/.env": not foundon every push tomainand thev0.6.2tag — a direct regression from the security fix.Fix: COPY the template
.env.setup(still tracked in git) to both paths instead. This is safe becausegodotenv.Load()(used byLoadEnvFiles()) never overrides an already-set OS environment variable — confirmed injoho/godotenvv1.5.1'sloadFile:if !currentEnv[key] || overload { ... }, andLoad()calls it withoverload=false. Real values injected via docker-composeenv_file/environmentalways take precedence; the baked-in template only fills gaps.Verified locally:
docker build -f Dockerfile.mciammanager --target prod .succeeds, and/app/.env//.envexist inside the built image.Note
Releases up to v0.6.1 had
.envtracked in git, so their image builds would have succeeded with the originalCOPY .env ...— meaning any real secrets in that.envat build time may have been baked into image layers pushed to the publiccloudbaristaorg/mc-iam-managerDocker Hub repo. That's a separate concern from this build fix and needs its own investigation/rotation, out of scope here.Migration Notes
v0.6.2's Docker image build was broken before this fix — once merged, thev0.6.2tag's CD run can be re-triggered (or a new patch tag cut) to actually publish the image.