update docs, add make gen

Author: mafredri

Makefile

@@ -29,6 +29,9 @@ develop:
 build: scripts/envbuilder-$(GOARCH)
 	./scripts/build.sh
 
+.PHONY: gen
+gen: docs/env-variables.md update-golden-files
+
 .PHONY: update-golden-files
 update-golden-files: .gen-golden
 
@@ -85,4 +88,4 @@ test-images-pull:
 	docker push localhost:5000/envbuilder-test-ubuntu:latest
 
 .registry-cache/docker/registry/v2/repositories/envbuilder-test-codercom-code-server:
-	docker push localhost:5000/envbuilder-test-codercom-code-server:latest
+	docker push localhost:5000/envbuilder-test-codercom-code-server:latest

docs/container-registry-auth.md

@@ -14,9 +14,19 @@ After you have a configuration that resembles the following:
 }
 ```
 
-`base64` encode the JSON and provide it to envbuilder as the `ENVBUILDER_DOCKER_CONFIG_BASE64` environment variable.
+`base64` encode the JSON and provide it to envbuilder as the
+`ENVBUILDER_DOCKER_CONFIG_BASE64` environment variable.
 
-Alternatively, if running `envbuilder` in Kubernetes, you can create an `ImagePullSecret` and
+Alternatively, the configuration file can be placed in `/.envbuilder/config.json`.
+The `DOCKER_CONFIG` environment variable can be used to define a custom path. The
+path must either be the path to a directory containing `config.json` or the full
+path to the JSON file itself.
+
+> [!NOTE] Providing the docker configuration through other means than the
+> `ENVBUILDER_DOCKER_CONFIG_BASE64` environment variable will leave the
+> configuration file in the container filesystem. This may be a security risk.
+
+When running `envbuilder` in Kubernetes, you can create an `ImagePullSecret` and
 pass it into the pod as a volume mount. This example will work for all registries.
 
 ```shell

docs/env-variables.md

@@ -15,7 +15,7 @@
 | `--dockerfile-path` | `ENVBUILDER_DOCKERFILE_PATH` |  | The relative path to the Dockerfile that will be used to build the workspace. This is an alternative to using a devcontainer that some might find simpler. |
 | `--build-context-path` | `ENVBUILDER_BUILD_CONTEXT_PATH` |  | Can be specified when a DockerfilePath is specified outside the base WorkspaceFolder. This path MUST be relative to the WorkspaceFolder path into which the repo is cloned. |
 | `--cache-ttl-days` | `ENVBUILDER_CACHE_TTL_DAYS` |  | The number of days to use cached layers before expiring them. Defaults to 7 days. |
-| `--docker-config-base64` | `ENVBUILDER_DOCKER_CONFIG_BASE64` |  | The base64 encoded Docker config file that will be used to pull images from private container registries. |
+| `--docker-config-base64` | `ENVBUILDER_DOCKER_CONFIG_BASE64` |  | The base64 encoded Docker config file that will be used to pull images from private container registries. When this is set, Docker configuration set via the DOCKER_CONFIG environment variable is ignored. |
 | `--fallback-image` | `ENVBUILDER_FALLBACK_IMAGE` |  | Specifies an alternative image to use when neither an image is declared in the devcontainer.json file nor a Dockerfile is present. If there's a build failure (from a faulty Dockerfile) or a misconfiguration, this image will be the substitute. Set ExitOnBuildFailure to true to halt the container if the build faces an issue. |
 | `--exit-on-build-failure` | `ENVBUILDER_EXIT_ON_BUILD_FAILURE` |  | Terminates the container upon a build failure. This is handy when preferring the FALLBACK_IMAGE in cases where no devcontainer.json or image is provided. However, it ensures that the container stops if the build process encounters an error. |
 | `--force-safe` | `ENVBUILDER_FORCE_SAFE` |  | Ignores any filesystem safety checks. This could cause serious harm to your system! This is used in cases where bypass is needed to unblock customers. |

options/options.go

@@ -277,7 +277,9 @@ func (o *Options) CLI() serpent.OptionSet {
 			Env:   WithEnvPrefix("DOCKER_CONFIG_BASE64"),
 			Value: serpent.StringOf(&o.DockerConfigBase64),
 			Description: "The base64 encoded Docker config file that " +
-				"will be used to pull images from private container registries.",
+				"will be used to pull images from private container registries. " +
+				"When this is set, Docker configuration set via the DOCKER_CONFIG " +
+				"environment variable is ignored.",
 		},
 		{
 			Flag:  "fallback-image",

options/testdata/options.golden

@@ -47,7 +47,9 @@ OPTIONS:
 
       --docker-config-base64 string, $ENVBUILDER_DOCKER_CONFIG_BASE64
           The base64 encoded Docker config file that will be used to pull images
-          from private container registries.
+          from private container registries. When this is set, Docker
+          configuration set via the DOCKER_CONFIG environment variable is
+          ignored.
 
       --dockerfile-path string, $ENVBUILDER_DOCKERFILE_PATH
           The relative path to the Dockerfile that will be used to build the

scripts/docsgen/main.go

@@ -16,5 +16,5 @@ func main() {
 	if err != nil {
 		panic(err)
 	}
-	fmt.Printf("%s updated successfully with the latest flags!", path)
+	fmt.Printf("%s updated successfully with the latest flags!\n", path)
 }