Kamal in bitbucket pipelines: Passing ssh key to Dockerfile to install gems from private repos

[mariedevops]

Hi everyone! We really need some help with integrating a manual step "kamal deploy" in a bitbucket pipeline. Among other things our dockerfile needs to install something from a private repo which would give us a very well-known ssh error.
While I found a way to access that repo when running kamal deploy from the local machine using builders: ssh: default=$SSH_AUTH_SOCK in config/deploy.yml and adding RUN --mount=type=ssh bundle install to Dockerfile, this does not seem to be possible in BB. Of course BB has env vars and ssh key but Dockerfile won't pick them up. Also, BB has no buildx/multiarch which makes things more complicated. I would appreciate any help.

[NicolasCharpentier]

I've done such thing some years ago, I think I remember that using the --mount was not working.

This is why I ended up with this solution :

• For the build stage in bitbucket pipeline : - docker build ... --build-arg ssh_private_key="$(cat the_ssh_key)"
• In the Dockerfile

FROM ...

ARG ssh_private_key

RUN mkdir -p -m 0777 HOME_PATH.../.ssh && \
    echo "$ssh_private_key" > HOME_PATH.../.ssh/id_rsa && \
    chmod 600 HOME_PATH.../.ssh/id_rsa && \
    composer install --no-scripts --no-dev --optimize-autoloader && \
    rm -rf HOME_PATH.../.ssh

So my command composer install was able to install private repositories.

Note how the key is removed in the same command it used in, to not leave it anywhere after being used. (Docker multi-stage building could also help about that)
Note that this is not the most secured approach (see Docker configuration about the mount flag), that's why we at least bother to leave no trace of the key.