Build secret with NextJs and Docker

[hass]

Hello,

This issue may have already been discussed in some topics, but it remains unclear and difficult to understand why Fly.io does not support secrets during builds.

–
Let me show you my setup :

In Github Secrets :

In GitHub Action:

In the Dockerfile:

And in case, in Fly Secrets:

–
Let’s try to build first locally (before to build in the CI):

flyctl deploy \                                                                            main * ] 1:43 pm
          --config packages/bo/fly.toml \  
          --build-secret NEXT_PUBLIC_BO_BACK=https://apps.fly.dev/ \
          -a app-bo

When Docker builds run:

The variable is empty despite the --build-secret NEXT_PUBLIC_BO_BACK=https://apps.fly.dev/ in the fly deploy command line

I added logs in the app at startup, but the variable is empty:

How can I make that work?

best

[rubys]

echo NEXT_PUBLIC_BO_BACK=$NEXT_PUBLIC_BO_BACK

Note that that will evaluate $NEXT_PUBLIC_BO_BACK as a Docker ARG, not as an environment variable. Even if you escape the $, you aren’t running a shell so you won’t get expansion.

I tried launching from a directory containing a single Dockerfile:

FROM ubuntu:latest
RUN --mount=type=secret,id=NEXT_PUBLIC_BO_BACK \
  NEXT_PUBLIC_BO_BACK="$(cat /run/secrets/NEXT_PUBLIC_BO_BACK)" \
  env > /etc/secret
CMD [ 'sleep', 'infinity' ]

Ran

fly deploy --build-secret NEXT_PUBLIC_BO_BACK=testdata

And then:

% fly console -C "cat /etc/secret" | grep NEXT_PUBLIC   
Connecting to fdaa:0:d445:a7b:2d6:32aa:6b1a:2...
NEXT_PUBLIC_BO_BACK=testdata

[hass]

Thank you