hack: allow passing config file to test and shell script

One should not use their regular docker credentials here
but make a special config file with only public readonly
token inside.

Signed-off-by: Tonis Tiigi <[email protected]>

Author: tonistiigi

.github/CONTRIBUTING.md

@@ -164,6 +164,10 @@ CGO_ENABLED=1 GOBUILDFLAGS="-race" ./hack/test integration
 Set `TEST_KEEP_CACHE=1` for the test framework to keep external dependant images in a docker volume
 if you are repeatedly calling `./hack/test` script. This helps to avoid rate limiting on the remote registry side.
 
+You can also set `MOUNT_BUILDKIT_DOCKER_CONFIG_PATH` to forward docker config that will be used to pull
+test images into the container. Don't use your personal docker config, create a new one with a dedicated
+token that only has public read-only access.
+
 If you are working behind a proxy, you can set some of or all
 `HTTP_PROXY=http://ip:port`, `HTTPS_PROXY=http://ip:port`, `NO_PROXY=http://ip:port` for the test framework
 to specify the proxy build args.

hack/shell

@@ -20,5 +20,12 @@ if [ -n "$MOUNT_BUILDKIT_SOURCE" ]; then
   volumes="-v $(pwd):/src"
 fi
 
+config=
+if [ -n "$MOUNT_BUILDKIT_DOCKER_CONFIG_PATH" ]; then
+  if [ -f "$MOUNT_BUILDKIT_DOCKER_CONFIG_PATH" ]; then
+    config="-v $MOUNT_BUILDKIT_DOCKER_CONFIG_PATH:/root/.docker/config.json:ro"
+  fi
+fi
+
 set -x
-docker run $SSH $volumes -it --privileged -v /tmp -e BUILDKIT_REGISTRY_MIRROR_DIR=/root/.cache/registry --rm $(cat $iidfile) ash
+docker run $SSH $volumes $config -it --privileged -v /tmp -e BUILDKIT_REGISTRY_MIRROR_DIR=/root/.cache/registry --rm $(cat $iidfile) ash

hack/test

@@ -29,6 +29,7 @@ set -eu -o pipefail
 : "${DOCKERFILE_RELEASES=}"
 : "${BUILDKIT_WORKER_RANDOM=}"
 : "${BUILDKIT_TEST_DISABLE_FEATURES=}"
+: "${MOUNT_BUILDKIT_DOCKER_CONFIG_PATH=}"
 
 if [ "$TEST_DOCKERD" == "1" ]; then
   if [ ! -f "$TEST_DOCKERD_BINARY" ]; then
@@ -108,8 +109,11 @@ if [ "$TEST_KEEP_CACHE" != "1" ]; then
 fi
 
 dockerConfigMount=""
-if [ "$GITHUB_ACTIONS" = "true" ]; then
+if [ "$GITHUB_ACTIONS" = "true" ] || [ -n "$MOUNT_BUILDKIT_DOCKER_CONFIG_PATH" ]; then
   dockerConfigPath="$HOME/.docker/config.json"
+  if [ -n "$MOUNT_BUILDKIT_DOCKER_CONFIG_PATH" ]; then
+    dockerConfigPath="$MOUNT_BUILDKIT_DOCKER_CONFIG_PATH"
+  fi
   if [ -f "$dockerConfigPath" ]; then
     dockerConfigMount="-v $dockerConfigPath:/root/.docker/config.json:ro"
   fi