eleith
66d9f94216
ci/woodpecker/pr/build-dane-verify Pipeline was successful
ci/woodpecker/pr/build-porkbun-ddns Pipeline was successful
ci/woodpecker/push/build-dane-verify Pipeline was successful
ci/woodpecker/push/build-hledger Pipeline was successful
ci/woodpecker/push/build-nvim Pipeline was successful
ci/woodpecker/push/build-playwright Pipeline was successful
ci/woodpecker/push/build-porkbun-ddns Pipeline was successful
31 lines
982 B
Markdown
31 lines
982 B
Markdown
# 🔐 Secrets
|
|
|
|
## Files
|
|
|
|
- Store credentials outside the repo and mount them read-only.
|
|
- Keep credentials out of images, logs, and command arguments.
|
|
- Follow the container README for the required file format and mount destination.
|
|
|
|
Bind mount source paths refer to the Docker host, including jobs launched by a
|
|
scheduler container.
|
|
|
|
## Users and permissions
|
|
|
|
Mounted files retain their host ownership and permissions. Check them with:
|
|
|
|
```bash
|
|
stat -c '%u:%g %a' /path/to/credentials.json
|
|
```
|
|
|
|
Set the container's `--user` to a UID:GID that can read the file. For a file owned
|
|
by your current host user, use `--user "$(id -u):$(id -g)"`. In Compose, set `user:`
|
|
on the service reading the file.
|
|
|
|
The scheduler and each container it launches have their own runtime user.
|
|
Keep credential files restricted to the users that need them.
|
|
|
|
## CI
|
|
|
|
Use GitHub Actions secrets and Woodpecker `from_secret` for registry and
|
|
notification credentials. Scope them to the steps that need them.
|