Skip to content

Commit ae61d33

Browse files
LeechaelLeechael
committed
add example for prelaunch script that login to private registry
1 parent b48df8c commit ae61d33

2 files changed

Lines changed: 154 additions & 0 deletions

File tree

‎prelaunch-script-private-registry/README.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# DStack Pre-Launch Script: Private Registry Support
2+
3+
## Overview
4+
5+
This directory contains a real-world example of a pre-launch script for DStack applications. The script demonstrates how to authenticate with private container registries (Docker Hub or AWS ECR) using encrypted environment variables before launching your application.
6+
7+
Pre-launch scripts were introduced in DStack v0.3.5 (as detailed in [#94](https://github.com/Dstack-TEE/dstack/pull/94)) and enable applications to perform preliminary setup steps before Docker Compose initialization.
8+
9+
## How It Works
10+
11+
The script (version v0.0.1) performs the following operations:
12+
13+
- Checks for specific encrypted environment variables
14+
- Authenticates with Docker Hub using the Docker CLI if Docker Hub credentials are provided
15+
- Authenticates with AWS ECR using the AWS CLI if AWS credentials are provided
16+
- Installs AWS CLI automatically if it's not available (when using AWS ECR)
17+
- Performs Docker cleanup by pruning unused images and volumes
18+
- Does nothing by default if no credentials are provided
19+
- Exits with error code 1 if authentication fails
20+
21+
## Configuration
22+
23+
### Docker Hub Authentication
24+
25+
To authenticate with Docker Hub, configure these encrypted environment variables:
26+
27+
- `DSTACK_DOCKER_USERNAME` - Your Docker Hub username
28+
- `DSTACK_DOCKER_PASSWORD` - Your Docker Hub password or access token
29+
30+
### AWS ECR Authentication
31+
32+
To authenticate with AWS ECR, configure these encrypted environment variables:
33+
34+
- `DSTACK_AWS_ACCESS_KEY_ID` - Your AWS access key ID
35+
- `DSTACK_AWS_SECRET_ACCESS_KEY` - Your AWS secret access key
36+
- `DSTACK_AWS_REGION` - The AWS region where your ECR repository is located
37+
- `DSTACK_AWS_ECR_REGISTRY` - Your AWS ECR registry URL
38+
39+
## Usage
40+
41+
1. Set up the required encrypted environment variables for your chosen registry
42+
2. Reference this pre-launch script in your `app-compose.json` file in the `pre_launch_script` section
43+
3. Deploy your application using DStack
44+
45+
## Security Features
46+
47+
- The script uses `--password-stdin` when logging in to Docker to prevent credentials from appearing in process lists
48+
- Credentials are handled securely, never exposed in logs or error messages
49+
- For AWS ECR, the script verifies the AWS CLI installation package with MD5 checksum
50+
- The script checks if you're already logged in to avoid unnecessary authentication attempts
51+
52+
## Notes
53+
54+
- The pre-launch script is executed before Docker Compose initialization
55+
- No authentication is performed if the required environment variables are not provided
56+
- The script automatically performs Docker cleanup to free up space by removing unused images and volumes
57+
- You can modify the script to support additional private container registries as needed

‎prelaunch-script-private-registry/prelaunch.sh‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
#!/bin/bash
2+
echo "----------------------------------------------"
3+
echo "Running Phala Cloud Pre-Launch Script v0.0.1"
4+
echo "----------------------------------------------"
5+
set -e
6+
7+
# Function: Perform Docker cleanup
8+
perform_cleanup() {
9+
echo "Pruning unused images"
10+
docker image prune -af
11+
echo "Pruning unused volumes"
12+
docker volume prune -f
13+
}
14+
15+
# Function: Check Docker login status without exposing credentials
16+
check_docker_login() {
17+
# Try to verify login status without exposing credentials
18+
if docker info 2>/dev/null | grep -q "Username"; then
19+
return 0
20+
else
21+
return 1
22+
fi
23+
}
24+
25+
# Function: Check AWS ECR login status
26+
check_ecr_login() {
27+
# Check if we can access the registry without exposing credentials
28+
if aws ecr get-authorization-token --region $DSTACK_AWS_REGION &>/dev/null; then
29+
return 0
30+
else
31+
return 1
32+
fi
33+
}
34+
35+
# Main logic starts here
36+
echo "Starting login process..."
37+
38+
# Check if Docker credentials exist
39+
if [[ -n "$DSTACK_DOCKER_USERNAME" && -n "$DSTACK_DOCKER_PASSWORD" ]]; then
40+
echo "Docker credentials found"
41+
42+
# Check if already logged in
43+
if check_docker_login; then
44+
echo "Already logged in to Docker registry"
45+
else
46+
echo "Logging in to Docker registry..."
47+
# Login without exposing password in process list
48+
echo "$DSTACK_DOCKER_PASSWORD" | docker login -u "$DSTACK_DOCKER_USERNAME" --password-stdin
49+
50+
if [ $? -eq 0 ]; then
51+
echo "Docker login successful"
52+
else
53+
echo "Docker login failed"
54+
exit 1
55+
fi
56+
fi
57+
# Check if AWS ECR credentials exist
58+
elif [[ -n "$DSTACK_AWS_ACCESS_KEY_ID" && -n "$DSTACK_AWS_SECRET_ACCESS_KEY" && -n "$DSTACK_AWS_REGION" && -n "$DSTACK_AWS_ECR_REGISTRY" ]]; then
59+
echo "AWS ECR credentials found"
60+
61+
# Check if AWS CLI is installed
62+
if ! command -v aws &> /dev/null; then
63+
echo "AWS CLI not installed, installing..."
64+
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
65+
echo "6ff031a26df7daebbfa3ccddc9af1450 awscliv2.zip" | md5sum -c
66+
if [ $? -ne 0 ]; then
67+
echo "MD5 checksum failed"
68+
exit 1
69+
fi
70+
unzip awscliv2.zip &> /dev/null
71+
./aws/install
72+
73+
# Clean up installation files
74+
rm -rf awscliv2.zip aws
75+
else
76+
echo "AWS CLI is already installed: $(which aws)"
77+
fi
78+
79+
# Configure AWS CLI
80+
aws configure set aws_access_key_id "$DSTACK_AWS_ACCESS_KEY_ID"
81+
aws configure set aws_secret_access_key "$DSTACK_AWS_SECRET_ACCESS_KEY"
82+
aws configure set default.region $DSTACK_AWS_REGION
83+
echo "Logging in to AWS ECR..."
84+
aws ecr get-login-password --region $DSTACK_AWS_REGION | docker login --username AWS --password-stdin "$DSTACK_AWS_ECR_REGISTRY"
85+
if [ $? -eq 0 ]; then
86+
echo "AWS ECR login successful"
87+
else
88+
echo "AWS ECR login failed"
89+
exit 1
90+
fi
91+
fi
92+
93+
perform_cleanup
94+
95+
echo "----------------------------------------------"
96+
echo "Script execution completed"
97+
echo "----------------------------------------------"

0 commit comments

Comments
 (0)