Docker RUN Instruction with a Mounted Secret in Exec Form

Question

What is the proper syntax for a RUN instruction in a Dockerfile, that requires mounting a secret, in exec form?

In other words, if a Dockerfile that looks something like:

FROM node:fermium-alpine

# . . .

RUN --mount=type=secret,id=npmrc yarn build:production

# . . .

how could the RUN instruction above be converted from shell form to exec form? There doesn't seem to be an example in the official docs here.

Answer 1

FROM node:fermium-alpine


WORKDIR /usr/src/app

# . . .

RUN --mount=type=secret,id=npmrc,dst=/usr/src/app/.npmrc ["/usr/local/bin/yarn", \
                                                          "build:production"]

# . . .

Note:

• The --mount flag is kept outside of the JSON array to its right
• The dst=. . . has been added to the --mount flag above to ensure that .npmrc is not only saved as a dotfile, but that it is saved in the WORKDIR so that yarn can use it during the build
• RUN instructions with the --mount= . . .,dst=. . . in exec form can get lengthy; use \ to split long lines in a Dockerfile (taken from Dockerfile best practices here)
• Just to be on the safe side, since shell form is not being used here, the yarn executable was replaced with the absolute path /usr/local/bin/yarn for the node:fermium-alpine image