BuildKit والـ Build Secrets: الـ token ما يدخلش الـ image

// secrets.js: الـ parsing بتاع الـ Dockerfile والـ RUN mounts، وسطر الـ history، و scanner للـ secrets في الـ image، و lint

const SECRET_NAME = /(TOKEN|SECRET|PASSWORD|PASSWD|API_?KEY|PRIVATE_?KEY)/i;
const SECRET_FILES = /(^|\/)(\.npmrc|\.env(\..+)?|\.netrc|id_rsa|id_ed25519|[^/]+\.pem|[^/]+\.key)$/;

export function parseInstructions(text) {
  const out = [];
  for (const raw of text.replace(/\\\n/g, " ").split("\n")) {
    const line = raw.trim();
    if (!line || line.startsWith("#")) continue;
    const [, op, rest = ""] = /^(\S+)\s*(.*)$/.exec(line);
    out.push({ op: op.toUpperCase(), args: rest.trim() });
  }
  return out;
}

export function parseRun(args) {
  const mounts = [];
  let rest = args.trim();
  for (let m; (m = /^--mount=(\S+)\s*/.exec(rest)); rest = rest.slice(m[0].length)) {
    const o = Object.fromEntries(m[1].split(",").map((kv) => { const [k, ...v] = kv.split("="); return [k, v.length ? v.join("=") : "true"]; }));
    const type = o.type ?? "bind";
    const mount = { type, ...o };
    if (type === "secret") { mount.target = o.target ?? o.dst ?? (o.env ? null : `/run/secrets/${o.id}`); mount.required = o.required === "true"; }
    if (type === "cache") { mount.target = o.target ?? o.dst; mount.id = o.id ?? mount.target; mount.sharing = o.sharing ?? "shared"; }
    mounts.push(mount);
  }
  return { mounts, cmd: rest };
}

export function historyLine(runArgs, argNames, vars) {
  const used = argNames.map((n) => `${n}=${vars[n] ?? ""}`);
  return `RUN ${used.length ? `|${used.length} ${used.join(" ")} ` : ""}/bin/sh -c ${parseRun(runArgs).cmd}`;
}

export function scanImage(image, secrets) {
  const out = [];
  for (const [name, value] of Object.entries(secrets)) {
    if (!value) continue;
    image.history.forEach((h, i) => { if (h.includes(value)) out.push({ secret: name, where: "HISTORY", detail: `history ${i + 1}` }); });
    for (const [k, v] of Object.entries(image.env)) if (String(v).includes(value)) out.push({ secret: name, where: "ENV", detail: k });
    image.layers.forEach((l, i) => {
      for (const [p, c] of l) if (c?.includes(value)) out.push({ secret: name, where: image.fs.get(p) === c ? "FS" : "LAYER", detail: `layer ${i + 1} ${p}` });
    });
  }
  return out;
}

export function lintDockerfile(text) {
  const out = [];
  const add = (rule, severity, index, msg) => out.push({ rule, severity, index, msg });
  parseInstructions(text).forEach(({ op, args }, i) => {
    const n = i + 1;
    if (op === "ARG" && SECRET_NAME.test(args.split("=")[0])) add("SECRET-ARG", "ERROR", n, `ARG ${args.split("=")[0]}: قيمته بتتسجّل في docker history`);
    if (op === "ENV") for (const [, k, v] of args.matchAll(/(\w+)=(\S+)/g)) if (SECRET_NAME.test(k) || SECRET_NAME.test(v)) add("SECRET-ENV", "ERROR", n, `ENV ${k}: بيفضل في الـ image config لأي حد يعمل inspect`);
    if (op === "COPY") for (const s of args.split(/\s+/).filter((x) => !x.startsWith("--")).slice(0, -1)) if (SECRET_FILES.test(s)) add("SECRET-FILE-COPY", "ERR
…

$ node lab.js

=== Dockerfile.arg ===
  lint ERROR SECRET-ARG (instruction 2): ARG NPM_TOKEN: قيمته بتتسجّل في docker history
  lint INFO NO-CACHE-MOUNT (instruction 5): npm ci من غير --mount=type=cache: كل build بينزّل كل حاجة من الأول
  اتبنت: @shop/ui موجودة | .npmrc في الـ image النهائية: false
  history: RUN |1 NPM_TOKEN=npm_SHOP7f3a9c /bin/sh -c echo "//npm.shop.dev/:_authToken=$NPM_TOKEN" > .npmrc && npm ci && rm .npmrc
  تسريب HISTORY: history 4

=== Dockerfile.half ===
  lint ERROR SECRET-PERSISTED (instruction 4): secret npmrc اتنسخ لـ file عادي: الـ file ده بيتحفَظ في الـ layer
  lint INFO NO-CACHE-MOUNT (instruction 4): npm ci من غير --mount=type=cache: كل build بينزّل كل حاجة من الأول
  اتبنت: @shop/ui موجودة | .npmrc في الـ image النهائية: false
  history: RUN /bin/sh -c cat /run/secrets/npmrc > .npmrc && npm ci
  history: RUN /bin/sh -c rm .npmrc
  تسريب LAYER: layer 2 /app/.npmrc

=== Dockerfile ===
  اتبنت: @shop/ui موجودة | .npmrc في الـ image النهائية: false
  مفيش تسريب

=== من غير الـ secret ===
  npm error code E401: الـ private registry محتاج token

=== الـ cache mount ===
  أول build: نزّل 2 | تاني build: نزّل 0، ومن الـ cache 2

FROM node:22-slim
ARG NPM_TOKEN
WORKDIR /app
COPY package.json ./
# الـ rm في نفس الـ RUN: الـ .npmrc مش هيتحفَظ في الـ layer... بس الـ token فين تاني؟
RUN echo "//npm.shop.dev/:_authToken=$NPM_TOKEN" > .npmrc && npm ci && rm .npmrc
COPY . .
ENV NODE_ENV=production
CMD ["node", "server.js"]

# syntax=docker/dockerfile:1
FROM node:22-slim
WORKDIR /app
COPY package.json ./
# secret mount، بس بننسخه لـ file عادي
RUN --mount=type=secret,id=npmrc cat /run/secrets/npmrc > .npmrc && npm ci
RUN rm .npmrc
COPY . .
ENV NODE_ENV=production
CMD ["node", "server.js"]

# syntax=docker/dockerfile:1
FROM node:22-slim AS deps
WORKDIR /app
COPY package.json ./
# الـ secret متركّب مكان .npmrc وقت الـ RUN ده بس، والـ npm cache بيعيش بين الـ builds
RUN --mount=type=secret,id=npmrc,target=/app/.npmrc \
    --mount=type=cache,target=/root/.npm \
    npm ci

FROM node:22-slim
WORKDIR /app
ENV NODE_ENV=production
COPY --from=deps /app/node_modules ./node_modules
COPY server.js package.json ./
USER node
CMD ["node", "server.js"]

# build.sh: الـ secret بييجي من بره وقت الـ build بس

# ١) من file على جهازك:
docker build --secret id=npmrc,src=$HOME/.npmrc -t shop-api:1.5.0 .

# ٢) من environment variable (في الـ CI):
NPM_TOKEN=... docker build --secret id=npm_token,env=NPM_TOKEN -t shop-api:1.5.0 .
#    وفي الـ Dockerfile: RUN --mount=type=secret,id=npm_token,env=NPM_TOKEN npm ci

# ٣) private git repo بالـ ssh agent بدل ما تنسخ id_rsa:
docker build --ssh default .
#    وفي الـ Dockerfile: RUN --mount=type=ssh git clone [email protected]:shop/ui.git

# ٤) compose:
#   services:
#     api:
#       build:
#         context: .
#         secrets: [npmrc]
#   secrets:
#     npmrc:
#       file: ~/.npmrc

# ٥) الـ cache بين الـ CI runners (الـ runner كل مرة جديد):
docker buildx build --cache-from type=gha --cache-to type=gha,mode=max --secret id=npmrc,src=.npmrc .

# اتأكد بنفسك:
docker history --no-trunc shop-api:1.5.0      # فيه token؟
docker inspect shop-api:1.5.0 --format '{{json .Config.Env}}'
docker save shop-api:1.5.0 | tar -x -C /tmp/img && grep -r "npm_" /tmp/img   # كل الـ layers

# build secret ≠ runtime secret:
# الـ token بتاع npm محتاجه وقت الـ build بس. الـ DATABASE_URL محتاجه وقت التشغيل،
# وده بييجي من الـ environment أو /run/secrets وقت docker run، مش جُوّه الـ image خالص.

// buildkit.js: simulator صغير لـ BuildKit (جاهز، ما تعدّلوش): FROM و ARG و ENV و WORKDIR و COPY و RUN بالـ mounts
// الـ RUN بيفهم: echo > و echo >> و cat > و cp و rm و npm ci. وبيستخدم parseInstructions و parseRun و historyLine من secrets.js
import { posix } from "node:path";
import { parseInstructions, parseRun, historyLine } from "./secrets.js";

const expand = (s, env) => s.replace(/\$\{(\w+)\}|\$(\w+)/g, (_, a, b) => env[a ?? b] ?? "");

export function build(text, { context = {}, args = {}, secrets = {}, cache = new Map() } = {}) {
  const stages = [];
  let st = null;
  const log = [];
  let cacheHits = 0;
  for (const { op, args: a } of parseInstructions(text)) {
    if (op === "FROM") {
      const [, image, name] = /^(\S+)(?:\s+AS\s+(\S+))?/i.exec(a);
      const base = stages.find((s) => s.name === image);
      st = { name: name ?? String(stages.length), cwd: "/", argNames: [], vars: {}, env: { ...(base?.env ?? {}) }, layers: base ? [...base.layers] : [], history: base ? [...base.history] : [] };
      stages.push(st);
      continue;
    }
    const view = () => { const fs = new Map(); for (const l of st.layers) for (const [p, c] of l) c === null ? fs.delete(p) : fs.set(p, c); return fs; };
    const abs = (p) => posix.resolve(st.cwd, p);
    const layer = new Map();
    if (op === "ARG") {
      const [name, def] = a.split("=");
      st.argNames.push(name);
      st.vars[name] = args[name] ?? def ?? "";
      st.history.push(`ARG ${a}`);
      continue;
    }
    const scope = () => ({ ...st.vars, ...st.env });
    if (op === "ENV") {
      for (const [, k, v] of a.matchAll(/(\w+)=(\S+)/g)) st.env[k] = expand(v, scope());
      st.history.push(`ENV ${Object.entries(st.env).map(([k, v]) => `${k}=${v}`).join(" ")}`);
      continue;
    }
    if (op === "WORKDIR") { st.cwd = abs(expand(a, scope())); st.history.push(`WORKDIR ${st.cwd}`); continue; }
    if (op === "COPY") {
      const parts = a.split(/\s+/);
      const from = parts[0].startsWith("--from=") ? parts.shift().slice(7) : null;
      const dst = parts.pop();
      const src = from ? (() => { const s = stages.find((x) => x.name === from); const fs = new Map(); for (const l of s.layers) for (const [p, c] of l) c === null ? fs.delete(p) : fs.set(p, c); return fs; })() : new Map(Object.entries(context).map(([p, c]) => ["/" + p, c]));
      for (const s of parts) {
        const root = s === "." ? "/" : posix.resolve("/", s);
        for (const [p, c] of src) {
          if (!(p === root || p.startsWith(root === "/" ? "/" : root + "/"))) continue;
          const rel = p === root ? posix.basename(p) : posix.relative(root, p);
          const target = dst.endsWith("/") || parts.length > 1 || root === "/" || p !== root ? posix.join(abs(dst), rel) : abs(dst);
          layer.set(target, c);
        }
      }
      st.layers.push(layer);
      st.history.push(`COPY ${a}`);
      continue;
    }
    if (op === "RUN") {
      const { mounts, cmd } = parseRun(a);
      const env = s
…