ci: add .dockerignore to exclude env files to prevent potential key leakages 避免潜在的密钥泄漏 #3511
+8
−0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changes are made 变更的内容
Add a
.dockerignore
file to exclude the env files when building the image locally.添加了
.dockerignore
文件,以在本地构建镜像时排除环境变量相关文件。Why does it matter 变更的原因
When developing and building the docker image locally, if a
.env
file is used to specify the API key and access code, it will be included in the image that is built locally, thus leads to a secret key leak when the image is pushed to a public docker registry.(This week we encountered an OpenAI API key leakage. Upon investigation, it was found to be caused by the inclusion of the
.env
file in the image.)在本地开发和构建Docker镜像时,如果使用.env文件来指定API密钥和密码,并在本地构建镜像,
.env
文件将会包含在构建的镜像中。当该镜像被推到公开的Docker Registry时,会导致密钥泄露。(本周遇到了OpenAI API密钥泄露的问题,经排查发现为镜像中包含
.env
文件所致)How the .env file is included into the image
The file structure inside the image