How to substitute a command output into a string and append that to a file (in Alpine Linux running in Docker)

Question

I'm trying to build the following Dockerfile:

FROM alpine:latest
EXPOSE 9050 9051
RUN apk --update add tor
RUN echo "ControlPort 9051" >> /etc/tor/torrc
RUN password_hash=$(tor --hash-password "foo")
RUN echo "HashedControlPassword $password_hash" >> /etc/tor/torrc
CMD ["tor"]

I'm trying to add the line HashedControllPassword [pw] to /etc/tor/torrc, where [pw] is generated by the command tor --hash-password "foo". (I'm using "foo" as password in this example).

If I build the image using docker build --tag my_tor . and enter the command line using

docker run -it my_tor /bin/ash

and run cat /etc/tor/torrc, I see

ControlPort 9051
HashedControlPassword

In other words, in the end the torrc doesn't seem to contain the hashed password. However, similar commands in my Ubuntu terminal do work. Can anyone spot what the problem is?

Use ENV password_hash xxx or something similar, as What you do is only valid in this RUN and not later — user2915097
– user2915097, Commented Apr 28, 2017 at 16:01

Sebastian · Accepted Answer · 2017-04-28 14:56:56Z

3

You can use ARG

FROM alpine:latest
EXPOSE 9050 9051
ARG password
RUN apk --update add tor
RUN echo "ControlPort 9051" >> /etc/tor/torrc
RUN echo "HashedControlPassword $(tor --hash-password $password)" >> /etc/tor/torrc
CMD ["tor"]

And then build using:

docker build --build-arg password=foo Dockerfile

In general I would not bake password in an image. It would be better to provide those things when you run the container using -e.

answered Apr 28, 2017 at 14:56

Sebastian

17.6k5 gold badges51 silver badges57 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Kurt Peek Over a year ago

With this Dockerfile the second line of /etc/tor/torrc ends up as

HashedControlPassword Apr 28 15:11:03.587 [warn] You are running Tor as root. You don't need to, and you probably shouldn't. 16:B93F54A5908CE0D7600AA8DA98933FD4BA5F903A71A83B776B1EF7F52A

. So an entire warning message has been accidentally included. How can I prevent this?

Kurt Peek Over a year ago

Regarding my previous comment, the warning can be suppressed by using Tor's --quiet argument: tor --quiet --hash-password "foo".

Collectives™ on Stack Overflow

How to substitute a command output into a string and append that to a file (in Alpine Linux running in Docker)

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related