local build with secret sudo password

[rob4acre]

Hi,
First of all thanks for making these images available and maintaining them. I find them useful for learning and using in some projects.

I have been trying to build the images locally and using the ARG_SUDO_PW to set a specific sudo password. This works fine using something like

./builder.sh vnc build --build-arg ARG_SUDO_PW=secret

In this case, I think that the ARG_SUDO_PW is shown in the image layers and inspect

I tried to use the following to use a secret

./builder.sh vnc build --secret id=ARG_SUDO_PW,src=./secret_sudo_pw.txt

In order to use docker secrets to try and hide the chosen password. The build works, but the sudo pw is set to the default value.

Is there a way to set the sudo password and not have it appear in the final images?

Thanks in advance
Rob

[accetto]

Hello,

that's rigth, the value of the build argument ARG_SUDO_PW will appear in the final image.

You would need to change the sudo password during the container's run time.

It's easy to do it interactivelly:

passwd headless

So, conceptually you would need to do the same thing during the container startup.

However, that's not so simple as it seems. I would also need to find out, what actually works in this case.

What is the reason for changing the password?

Regards,
accetto

[accetto]

FYI: The handling of the initial sudo password has changed since the version G3v4 (as of the release 23.02).