Docker integration about artifacts-keyring HOT 4 CLOSED

The method creds = keyring.get_credential(index_url, None) seems to create a username/token combo that works on that feed, so if you are building on e.g. a windows laptop where you are using artifacts-keyring, then that can give you a token to pass into your docker build, but if you are e.g. building on a non-interactive machine (apart from azure devops pipeline build agents with the PipAuthenticateTask), I think you'll need to create a PAT in devops directly and use that as an environment variable into the build - see #8

from artifacts-keyring.

expanding on this, I have two use cases:

1. docker containers are built on an ephemeral build server in a server pool.
2. docker containers built by a script that runs a bunch of stuff including building the container on a dev's local box.

I used to just use a token which was injected into the extra-index-url. This was then introduced and it appears that likely whatever token I was using must have expired. I was hoping to figure out how to use this in those scenarios OR figure out how to use this to get a new token and prefferably how to generate a token with a headless build agent.

SOLVED:
make a new personal access token. In the top right of your Azure Dev Ops browser page.

This goes in your requirements.txt

--extra-index-url https://{{YOUR_FEED}}:{{YOUR_TOKEN}}@pkgs.dev.azure.com/{{YOUR_ORG}}/_packaging/{{YOUR_FEED}}/pypi/simple/
{{YOUR_PACKAGE_NAME}}=={{YOUR_VERSION}}

in your docker file:
Copy ./requirements.txt ./
RUN pip install -r requirements.txt

from artifacts-keyring.

Using secrets in Docker is ... tricky. You'll need to do something analogous to this: https://github.com/dotnet/dotnet-docker/blob/master/documentation/scenarios/nuget-credentials.md

from artifacts-keyring.

The above link is really the master cookbook. For some context, this tool is just a wrapper around https://github.com/microsoft/artifacts-credprovider so you can pass it the secret via VSS_NUGET_EXTERNAL_FEED_ENDPOINTS (yes it says NuGet, but don't worry about that 😊 ) see https://github.com/microsoft/artifacts-credprovider#environment-variables

You may also be interested in NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED

Some more info on tokens:
https://docs.microsoft.com/en-us/azure/devops/pipelines/process/access-tokens?view=azure-devops&tabs=yaml
https://docs.microsoft.com/en-us/azure/devops/pipelines/build/variables?view=azure-devops&tabs=yaml#systemaccesstoken

from artifacts-keyring.