How to include CI_JOB_TOKEN in Dockerfile on gitlab?

Question

I'm having an issue where I seem to be struggling to pass the CI_JOB_TOKEN around my CI/CD flow so that I can download private gitlab npm modules from my Dockerfile.

my files look like this:

gitlab-ci.yml

image: tmaier/docker-compose:latest
  variables:
    CI_JOB_TOKEN: ${CI_JOB_TOKEN}

stages:
  - build

build:
  stage: build
  script:
    - docker-compose build --build-arg CI_JOB_TOKEN=${CI_JOB_TOKEN}
    - docker-compose push --arg CI_JOB_TOKEN=${CI_JOB_TOKEN}

docker-compose.yml

services:
  qa-service:
    build:
      context: .
      args:
        PORT: 3000
        CI_JOB_TOKEN: ${CI_JOB_TOKEN}

Dockerfile

FROM ubuntu:latest

ARG CI_JOB_TOKEN
RUN npm install \
    "git+https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.example.com/xxx/yyy.git"

I keep getting this error

npm ERR! Error while executing:

npm ERR! /usr/bin/git ls-remote -h -t https://gitlab-ci-token:%24%7BCI_JOB_TOKEN%7D@gitlab.example.com/xxx/yyy.git

npm ERR!

npm ERR! remote: HTTP Basic: Access denied

npm ERR! fatal: Authentication failed for 'https://gitlab-ci-token:%24%7BCI_JOB_TOKEN%7D@gitlab.example.com/xxx/yyy.git/'

npm ERR!

npm ERR! exited with error code: 128

score 3 · Answer 1 · answered Nov 21 '18 at 11:42

Not sure whether this is still relevant, but I've figured out, that for some reason one has to declare an ENV named CI_JOB_TOKEN as well (In this case in combination with maven), otherwise there will be an authentication failure, e.g. when trying to access the GitLab maven repository.

As a workaround, I suggest using a multi-stage build, so the CI_JOB_TOKEN won't be present in the final image, i.e.:

ARG CI_JOB_TOKEN

FROM maven:alpine as build

ENV CI_JOB_TOKEN=$CI_JOB_TOKEN

COPY . .

RUN mvn package -s ci_settings.xml

FROM java:8-jre-alpine

COPY --from=build PATH/TO/app.jar /app.jar

CMD exec java -jar /app.jar

This way the CI_JOB_TOKEN was successfully recognized as an environment variable and this I didn't get a 401 error anymore, when trying to access the GitLab maven repository.

I assume that this will also solve your problem and it's probably not a restriction of GitLab CI, but rather related to the way build arguments work in Docker.

Of course you will have to adapt these steps to your particular use-case.

score 0 · Answer 2 · answered May 24 '18 at 14:20

From what I can tell from your CI script, the variable syntax should be:

image: tmaier/docker-compose:latest
  variables:
    CI_JOB_TOKEN: $CI_JOB_TOKEN

ie $CI_JOB_TOKEN, not ${CI_JOB_TOKEN}.

You also do not need to use the variables section to define the CI_JOB_TOKEN, and just use $CI_JOB_TOKEN wherever you need it instead, as it is already a predefined variable.

As from the documentation.

How to include CI_JOB_TOKEN in Dockerfile on gitlab?

2 Answers2