├── .gitignore
├── .dockerignore
├── index.php
├── docker-compose.yml
├── composer.json
├── Dockerfile
└── README.md


/.gitignore:
--------------------------------------------------------------------------------
1 | vendor/
2 | auth.json
3 | 


--------------------------------------------------------------------------------
/.dockerignore:
--------------------------------------------------------------------------------
1 | vendor/
2 | .gitignore
3 | auth.json
4 | 


--------------------------------------------------------------------------------
/index.php:
--------------------------------------------------------------------------------
1 | <?php
2 | 
3 | require __DIR__.'/vendor/autoload.php';
4 | 
5 | echo 'Hello, World';
6 | 


--------------------------------------------------------------------------------
/docker-compose.yml:
--------------------------------------------------------------------------------
 1 | version: '3.9'
 2 | 
 3 | services:
 4 |   php:
 5 |     build:
 6 |       context: .
 7 |       secrets:
 8 |         - composer_auth
 9 | 
10 | secrets:
11 |   composer_auth:
12 |     file: ./auth.json
13 | 


--------------------------------------------------------------------------------
/composer.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "require": {
 3 |     "dunglas/my-private-repo": "dev-main"
 4 |   },
 5 |   "repositories": [
 6 |     {
 7 |       "type": "vcs",
 8 |       "url": "https://github.com/dunglas/my-private-repo.git"
 9 |     }
10 |   ]
11 | }
12 | 


--------------------------------------------------------------------------------
/Dockerfile:
--------------------------------------------------------------------------------
 1 | # syntax=docker/dockerfile:1
 2 | FROM php:alpine
 3 | 
 4 | WORKDIR /srv/app
 5 | 
 6 | # These packages haven't to be installed if you have a composer.lock file, which is a best practice
 7 | RUN apk add --no-cache git openssh-client
 8 | 
 9 | # Install Composer
10 | COPY --from=composer /usr/bin/composer /usr/bin/composer
11 | 
12 | # Copy the composer.json and composer.lock files
13 | COPY composer.* .
14 | 
15 | # Install the prod dependencies by allowing Docker to use the auth.json file of the host
16 | RUN --mount=type=secret,id=composer_auth,dst=/srv/app/auth.json composer install --no-dev --no-scripts --no-autoloader --no-progress --no-interaction
17 | 
18 | # auth.json must not be copied into the final image
19 | COPY . .
20 | 
21 | # Dump the autoloader
22 | RUN composer dump-autoload --classmap-authoritative --no-dev
23 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # Example: Securely Access Private Composer Packages
 2 | 
 3 | Following [my article "Securely Access Private Git Repositories and Composer Packages in Docker Builds"](https://dunglas.fr/2022/08/securely-access-private-git-repositories-and-composer-packages-in-docker-builds/) and [this discussion on Twitter](https://twitter.com/benjamindavies/status/1556900014965899269), here is an example of how to use an `auth.json` file mounted as a Docker secret file to download private Composer packages.
 4 | 
 5 | First, create a local `auth.json` file containing a GitHub Personal Access Token and update `composer.json` to reference a private package:
 6 | 
 7 | ```json
 8 | {
 9 |     "github-oauth": {
10 |         "github.com": "ghp_<your-token>"
11 |     }
12 | }
13 | ```
14 | 
15 | Build with Docker Compose: `docker compose build`
16 | 
17 | Build with Docker: `docker build --secret id=composer_auth,src=auth.json .`
18 | 


--------------------------------------------------------------------------------