title: Use github private repo deploy key inside build stage in docker for npm install
body: <p>My use case is that I have multiple express micro-services that use the same middleware and I would like to create a different repo in the format of an npm module for each middleware.</p>
  
  <p>Every repo is a private repo and can have a deploy key attached (can be different keys or the same)</p>
  
  <p>All of this works OK locally.  However when I try to use this with my docker-compose setup it fails on the npm install step, in the build stage.</p>
  
  <p>Dockerfile</p>
  
  <pre><code>FROM node:alpine
  RUN npm install --production
  CMD npm start
  </code></pre>
  
  <p>docker-compose.yml</p>
  
  <pre><code>services:
     node-api:
          build:
              context: .
              dockerfile: Dockerfile
  </code></pre>
  
  <p>I understand this doesn't work because I don't have the deploy key I use on my local system in the Docker context.</p>
  
  <p>I've looked around for a solution and none seem very easy/non hacky</p>
  
  <ol>
  <li><p>Copy the key in and squash (CONS: not sure how I do this in a docker-compose file)<a href="http://blog.cloud66.com/pulling-git-into-a-docker-image-without-leaving-ssh-keys-behind/" rel="noreferrer">http://blog.cloud66.com/pulling-git-into-a-docker-image-without-leaving-ssh-keys-behind/</a></p></li>
  <li><p>Copy the key in on the build step and add to image. (CONS: Not very secure :( )</p></li>
  <li><p>Use the key as a build argument. (CONS: see 2)</p></li>
  <li><p>Dockerise something like <a href="https://www.vaultproject.io/" rel="noreferrer">https://www.vaultproject.io/</a> run that up first, add the key and use that within the node containers to get the latest key. (CONS: probably lots of work, maybe other issues?)</p></li>
  <li><p>Use Docker secrets and docker stack deploy and store the key in docker secrets (CON: docker stack deploy has no support for docker volumes yet.  See here <a href="https://docs.docker.com/compose/bundles/#producing-a-bundle" rel="noreferrer">https://docs.docker.com/compose/bundles/#producing-a-bundle</a>  unsupported key 'volumes')</p></li>
  </ol>
  
  <p>My question is what is the most <strong>secure</strong> possible solution that is automated (minimal manual steps for users of the file)?  Time of implementation is less of a concern.  I'm trying to avoid checking in any sensitive data while making it easy for other people to run this locally.</p>