Passing secrets into the build process

[JohnSmall]

I see that there's a completely undocumented feature in Kamal that looks like it can pass secrets, e.g. RAILS_MASTER_KEY into the build process.

In a deploy.yml created by the latest version of Kamal (2.2.2) I found this

# Configure builder setup.
builder:
  arch: amd64
  # # Pass arguments and secrets to the Docker build process
  # args:
  #   RUBY_VERSION: 3.3.6
  # secrets:
    # - GITHUB_TOKEN
    # - RAILS_MASTER_KEY

Since args and secrets are separate sections then I'm guessing that args are passed in via the normal way in the docker command line, but secrets must be passed in using the Buildx secrets passing mechanism. But I can't get it to work.

I've tried following the instructions for extracting secrets in the buildx environment buildx secrets, I'm guessing that the environment variable RAILS_MASTER_KEY will end up inside the build process as the file run/secrets/rails_master_key. But it doesn't work.

Does anyone know how to use this feature?

[JohnSmall]

Whoops, my mistake, it's not undocumented. It is documented, but Kamal uses uppercase in the file name. So that RAILS_MASTER_KEY comes through as run/secrets/RAILS_MASTER_KEY. It's documented here,Kamal builders

Example,

In deploy.yml

builder:
  arch: amd64
  # # Pass arguments and secrets to the Docker build process
  # args:
  #   RUBY_VERSION: 3.3.6
  secrets:
    - RAILS_MASTER_KEY

In your Dockerfile

RUN --mount=type=secret,id=RAILS_MASTER_KEY,env=RAILS_MASTER_KEY \
  echo "Rails Masterkey: ${RAILS_MASTER_KEY}"

But keep in mind that the environment variable is only available for that one command. After that's finished it's gone