Using Private Images
To use private Docker images, specify the username and password in the auth field of your config.yml file. To protect the password, create an Environment Variable in the CircleCI Project Settings page, and then reference it:
jobs:
build:
docker:
- image: acme-private/private-image:321
auth:
username: mydockerhub-user # can specify string literal values
password: $DOCKERHUB_PASSWORD # or project environment variable reference
You can also use images from a private repository like gcr.io or quay.io—make sure to supply the full registry/image URL for the image key, and use the appropriate username/password for the auth key. For example:
- image: quay.io/project/image:tag
auth:
username: $QUAY_USERNAME
password: $QUAY_PASSWORD
Alternatively, you can utilize the machine executor to achieve the same thing:
version: 2
jobs:
build:
machine: true
working_directory: ~/my_app
steps:
# Docker is preinstalled, along with docker-compose
- checkout
# start proprietary DB using private Docker image
- run: |
docker login -u $DOCKER_USER -p $DOCKER_PASS
docker run -d --name db company/proprietary-db:1.2.3
CircleCI now supports pulling private images from Amazon’s ECR service. You can start using private images from ECR in one of three ways:
- Set your AWS credentials using the CircleCI AWS Integration.
- Set your AWS credentials using standard CircleCI private environment variables.
- Specify your AWS credentials in .circleci/config.yml using aws_auth:
version: 2
jobs:
build:
docker:
- image: account-id.dkr.ecr.us-east-1.amazonaws.com/org/repo:0.1
aws_auth:
aws_access_key_id: AKIAQWERVA # can specify string literal values
aws_secret_access_key: $ECR_AWS_SECRET_ACCESS_KEY # or project UI envar reference
Options 2 & 3 are virtually the same except that 3 lets you specify whatever variable name you want for the credentials. This can come in handy where you have different AWS credentials for different infrastructure. For example, lets say your SaaS app runs the speedier tests and deploys to staging infrastructure on every commit while for Git tag pushes, we run the full-blown test suite before deploying to production:
version: 2
jobs:
build:
docker:
- image: account-id.dkr.ecr.us-east-1.amazonaws.com/org/repo:0.1
aws_auth:
aws_access_key_id: $AWS_ACCESS_KEY_ID_STAGING
aws_secret_access_key: $AWS_SECRET_ACCESS_KEY_STAGING
steps:
- run:
name: "Every Day Tests"
command: "testing...."
- run:
name: "Deploy to Staging Infrastructure"
command: "something something darkside.... cli"
deploy:
docker:
- image: account-id.dkr.ecr.us-east-1.amazonaws.com/org/repo:0.1
aws_auth:
aws_access_key_id: $AWS_ACCESS_KEY_ID_STAGING
aws_secret_access_key: $AWS_SECRET_ACCESS_KEY_STAGING
steps:
- run:
name: "Full Test Suite"
command: "testing...."
- run:
name: "Deploy to Production Infrastructure"
command: "something something darkside.... cli"
workflows:
version: 2
main:
jobs:
- build:
filters:
tags:
only: /^\d{4}\.\d+$/
- deploy:
requires:
- build
filters:
branches:
ignore: /.*/
tags:
only: /^\d{4}\.\d+$/