compose-spec / compose-spec

The Compose specification

Home Page:https://compose-spec.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Enable compose to build Dockerfiles that use --security=insecure.

jvanheesch opened this issue · comments

What is the problem you're trying to solve

I have a multi-stage Dockerfile with multiple RUN --security=insecure docker ... instructions. I want docker compose build to be able to build the corresponding image, just like it can with any regular Dockerfile. I currently run into the following error:

failed to solve: failed to load LLB: security.insecure is not allowed

The Dockerfile currently looks as follows:

# syntax=docker/dockerfile:1-labs
FROM docker as builder
COPY ./run_docker.sh run_docker.sh
RUN --security=insecure ./run_docker.sh 'docker ...'
RUN --security=insecure ./run_docker.sh 'docker ...'
RUN --security=insecure ./run_docker.sh 'docker ...'
FROM openjdk:8-slim
COPY --from=builder /app /app
...

with run_docker.sh:

#!/bin/sh

# Start dockerd in the background
dockerd &
DOCKERD_PID=$!

# Wait until Docker daemon is ready
while ! docker info > /dev/null 2>&1; do
    echo "Waiting for Docker daemon to start..."
    sleep 1
done

sh -c "$@"

# Stop dockerd
kill $DOCKERD_PID
wait $DOCKERD_PID

Unrelated to the issue at hand - this run_docker.sh setup is very awkward, but I wanted separate instructions for each docker command, and could not find a better way to accomplish this. Any feedback on this awkward setup would be greatly appreciated.

I could build a similar image using docker commit, but I don't think this way of building images can be integrated with docker (compose) build. As such, this Dockerfile basically starts a container with a volume, does some stuff, and copies the volume to a new image.

Describe the solution you'd like
Based on #120, I think supporting --allow security.insecure would be appropriate.