(aws-ecr-assets): Allow docker image assets to access private data in builds

The docker build command has a --ssh option to allow the Docker Engine to forward SSH agent connections. This is useful if you have private assets stored somewhere which are required in the build (for example private git repositories referenced by cargo)

The proposal is to allow the flag --ssh with a value to passed to the docker build command outside of build_args (which CDK already supports but does not support this use case). For example my build command would look like this:

docker build --ssh default -t foobar .

Use Case

This is useful if you have private assets stored somewhere which are required in the build (for example private git repositories referenced by cargo)

Cargo for example looks like this:

[package]
name = "my_project"
[dependencies]
my_lib = { git = "ssh://[e-mail]/deadcore/my_lib.git", tag = "my_lib_0.1.0_47330eb"  }

Proposed Solution

The simplest thought I could think of is:

const dockerImage = new DockerImageAsset(this, 'docker-image', {
    directory: path.join(__dirname, ".."),
    ssh_forward: true,
});

or to allow full support of the SSH forwarding ability in Docker:

const dockerImage = new DockerImageAsset(this, 'docker-image', {
    directory: path.join(__dirname, ".."),
    ssh_forward: {
        'projecta': './projecta.pem',
        'projectb': './projectb.pem'
    },
});

Other

• Using SSH to access private data in builds
• Build secrets and SSH forwarding in Docker 18.09

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[christiangaetano]

@deadcore can you explain why build_args are not enough?

build_args (which CDK already supports but does not support this use case)

The ultimate goal here is not to consume an SSH key as a variable in a Dockerfile, but rather to define the optional --ssh flag used with the docker build command. This is a new flag that allows Docker to securely access host SSH credentials at build time.

Using build_args, you would get something like this:

docker build --build-arg --ssh=default

Desired command is:

docker build --ssh default

[eladb]

We will happily accept a contribution for this. Sounds reasonable to support.