dockerfile: how to build go project with private module?

[Jerry-yz]

Description

how to ues dockerfile build go project when go import private pkg

[chengxilo]

Maybe the documentation can help you: Docker Documentation.
And for the private pkg, I think you should do what you have done in your development when you import your private pkg. Writing the command you used into the Dockerfile is okay.

I apologize for any shortcomings in my English proficiency.🥲

[thaJeztah]

This question looks to be better for the BuildKit issue tracker, or perhaps better as a discussion there; let me transfer this ticket, and convert it, but I'll add some pointers after that.

[thaJeztah]

It's difficult to provide a "full" answer, as some of this may highly depend on your situation, but here's some pointers;

First of all;

• The "build" section in the manuals also contains various topics related to building; https://docs.docker.com/build/
• The "build secrets" section in that manual may be relevant for your use-case; https://docs.docker.com/build/building/secrets/
• Related to that; the Dockerfile syntax, and especially the secret mounts on RUN; https://docs.docker.com/reference/dockerfile/#run---mounttypesecret
• As your module is private, it may be needed to set additional options or environment variables to fetch the modules, such as GOPRIVATE; you may want to refer to the private modules section in the Go documentation.
• Those environment variables may not be needed when running the final image (assuming you're using multi-stage builds), those can be set as an ENV (or ARG) in the build-stage that fetches the modules.

One alternative is also to consider vendoring your dependencies (which is what the BuildKit repository does); but this is not a "one-size fits all" solution, and may depend on your situation. Vendoring the dependencies will allow you to handle fetching the dependencies ahead of time (so the Dockerfile may not need access to credentials when building), and can allows for building your Dockerfile in air-gapped / offline situations (it also may allow easier reviewing of changes in dependencies, and makes sure you can continue building even if a dependency module may disappear (go module's caching proxy does not protect against that)). Vendoring will add additional bloat to your code-repository though, and there may be some additional complexity involved (such as verifying the vendored dependencies, and updating them), so this solution may not be "for everyting".

On the documentation side; I notice that the "build overview" page has no tile for "secrets", and that neither the --mount type=secret, nor the docker build --secret flag cross-references the "build secrets" section. I think we should improve that to help discoverability (and maybe even link it from the "getting started" as well).

/cc @dvdksn

[thaJeztah]

☝️ I opened docker/buildx#2350 for improving the docs

[dvdksn]

I recently added an example of using private Go modules to build with GitHub Actions, see here: https://docs.docker.com/build/ci/github-actions/secrets/#ssh-mounts