Preliminary support for @SUMMONDOCKERARGS

Dockerfile

@@ -9,6 +9,7 @@ COPY go.mod go.sum ./
 
 RUN apk add --no-cache bash \
                        build-base \
+                       docker-cli \
                        git && \
     go mod download && \
     go get -u github.com/jstemmer/go-junit-report && \

Dockerfile.acceptance

@@ -5,7 +5,8 @@ RUN apk add --no-cache bash \
                        git \
                        libffi-dev \
                        ruby-bundler \
-                       ruby-dev
+                       ruby-dev \
+                       docker-cli
 
 # Install summon prerequisites
 WORKDIR /summon

docs/_includes/docker.md

@@ -16,8 +16,74 @@ Since Summon has pluggable providers, you aren't locked into any one solution fo
 managing your secrets.
 
 Summon makes it easy to inject secrets as environment variables into your Docker
-containers by taking advantage of Docker's `--env-file` argument. This is done
-on-demand by using the variable `@SUMMONENVFILE` in the arguments of the process
+containers by taking advantage of Docker's CLI arguments (`--env-file` or, `--env` and
+`--volume`. There are two options available. It's possible to mix and match as you see fit.
+
+## Docker --env and --volume arguments
+
+This is done on-demand by using the variable `@SUMMONDOCKERARGS` in the arguments of the
+ process you are running with Summon. This variable is replaced by combinations of the
+ Docker arguments `--env` and `--volume` such that the secrets injected by summon are
+ passed into the Docker container. The `--volume` arguments allow memory-mapped temporary
+ files from variables with the `!file` tag to be resolvable inside the container.
+
+**NOTE:** Using the `!file` tag with `@SUMMONDOCKERARGS` assumes that the Docker CLI is
+being run on the host that is used to create volume mounts to the container. For when
+this is not the case simply avoid using the `!file` tag, but be mindful that in that case
+you lose the benefits of memory-mapped temporary files.
+
+```bash
+$ summon -p keyring.py -D env=dev docker run @SUMMONDOCKERARGS deployer
+Checking credentials
+Deploying application
+```
+
+### @SUMMONDOCKERARGS Example
+
+The example below demonstrates the use of @SUMMONDOCKERARGS. For the sake of brevity
+we use an inline `secrets.yml` and the `/bin/echo` provider. Some points to note:
+
+1. `summon` is invoking `docker` as the child process.
+2. `@SUMMONDOCKERARGS` is replaced with a combination of `--env` and `--volume` arguments.
+3. Variable `D` uses the `!file` tag and therefore is the only one that
+results in a `--volume` argument. The path to this variable inside the container
+is as it is on the host.
+
+```bash
+secretsyml='
+A: |-
+  A_value with
+  multiple lines
+B: B_value
+C: !var C_value
+D: !var:file D_value
+'
+
+# The substitution of @SUMMONDOCKERARGS the docker run command below results in
+# something of the form:
+#
+# docker run --rm \
+#  --env A --env B --env C --env D \
+#  --volume /path/to/D:/path/to/D
+#  alpine ...
+#
+# The output from the command is shown below the command.
+
+summon --provider /bin/echo --yaml "${secretsyml}" \
+ docker run --rm @SUMMONDOCKERARGS alpine sh -c '
+printenv A;
+printenv B;
+printenv C;
+cat $(printenv D);
+'
+# A_value with
+# multiple lines
+# B_value
+# C_value
+# D_value
+```
+## Docker --env-file argument
+This is done on-demand by using the variable `@SUMMONENVFILE` in the arguments of the process
 you are running with Summon. This variable points to a memory-mapped file containing
 the variables and values from secrets.yml in VAR=VAL format.
 
@@ -27,7 +93,7 @@ Checking credentials
 Deploying application
 ```
 
-## Example
+### @SUMMONENVFILE Example
 
 Let's say we have a deploy script that needs to access our application servers on
 AWS and pull the latest version of our code. It should record the outcome of the

go.mod

@@ -2,6 +2,9 @@ module github.com/cyberark/summon
 
 require (
 	github.com/codegangsta/cli v1.20.0
+	github.com/docker/docker v20.10.2+incompatible
+	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/docker/go-units v0.4.0 // indirect
 	github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e // indirect
 	github.com/jtolds/gls v4.20.0+incompatible // indirect
 	github.com/kr/pretty v0.1.0 // indirect

go.sum

@@ -2,6 +2,13 @@ github.com/codegangsta/cli v1.20.0 h1:iX1FXEgwzd5+XN6wk5cVHOGQj6Q3Dcp20lUeS4lHNT
 github.com/codegangsta/cli v1.20.0/go.mod h1:/qJNoX69yVSKu5o4jLyXAENLRyk1uhi7zkbQ3slBdOA=
 github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/docker/docker v1.13.1 h1:IkZjBSIc8hBjLpqeAbeE5mca5mNgeatLHBy3GO78BWo=
+github.com/docker/docker v20.10.2+incompatible h1:vFgEHPqWBTp4pTjdLwjAA4bSo3gvIGOYwuJTlEjVBCw=
+github.com/docker/docker v20.10.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
+github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
+github.com/docker/go-units v0.4.0 h1:3uh0PgVws3nIA0Q+MwDC8yjEPf9zjRfZZWXZYDct3Tw=
+github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e h1:JKmoR8x90Iww1ks85zJ1lfDGgIiMDuIptTOhJq+zKyg=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=

internal/command/action.go

@@ -3,21 +3,27 @@ package command
 import (
 	"bytes"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"sort"
 	"strings"
 	"sync"
 	"syscall"
 
 	"github.com/codegangsta/cli"
+
 	prov "github.com/cyberark/summon/provider"
 	"github.com/cyberark/summon/secretsyml"
 )
 
 // ActionConfig is an object that holds all the info needed to run
 // a Summon instance
 type ActionConfig struct {
+	StdIn                io.Reader
+	StdOut               io.Writer
+	StdErr               io.Writer
 	Args                 []string
 	Provider             string
 	Filepath             string
@@ -30,8 +36,9 @@ type ActionConfig struct {
 	ShowProviderVersions bool
 }
 
-const ENV_FILE_MAGIC = "@SUMMONENVFILE"
-const SUMMON_ENV_KEY_NAME = "SUMMON_ENV"
+const EnvFileMagic = "@SUMMONENVFILE"
+const DockerArgsMagic = "@SUMMONDOCKERARGS"
+const SummonEnvKeyName = "SUMMON_ENV"
 
 // Action is the runner for the main program logic
 var Action = func(c *cli.Context) {
@@ -122,6 +129,9 @@ func runAction(ac *ActionConfig) error {
 	results := make(chan Result, len(secrets))
 	var wg sync.WaitGroup
 
+	var dockerArgs []string
+	var dockerArgsMutex sync.Mutex
+
 	for key, spec := range secrets {
 		wg.Add(1)
 		go func(key string, spec secretsyml.SecretSpec) {
@@ -144,6 +154,15 @@ func runAction(ac *ActionConfig) error {
 			}
 
 			k, v := formatForEnv(key, value, spec, &tempFactory)
+
+			// Generate @SUMMONDOCKERARGS
+			dockerArgsMutex.Lock()
+			defer dockerArgsMutex.Unlock()
+			if spec.IsFile() {
+				dockerArgs = append(dockerArgs, "--volume", v+":"+v)
+			}
+			dockerArgs = append(dockerArgs, "--env", k)
+
 			results <- Result{k, v, nil}
 			wg.Done()
 		}(key, spec)
@@ -171,17 +190,48 @@ EnvLoop:
 
 	// Append environment variable if one is specified
 	if ac.Environment != "" {
-		env[SUMMON_ENV_KEY_NAME] = ac.Environment
+		env[SummonEnvKeyName] = ac.Environment
 	}
 
 	setupEnvFile(ac.Args, env, &tempFactory)
 
+	// Setup Docker args
+	var argsWithDockerArgs []string
+	for _, arg := range ac.Args {
+		// Replace entire argument
+		if arg == DockerArgsMagic {
+			// Replace argument with slice of docker options
+			argsWithDockerArgs = append(argsWithDockerArgs, dockerArgs...)
+			continue
+		}
+
+		// Replace argument substring
+		idx := strings.Index(arg, DockerArgsMagic)
+		if idx >= 0 {
+			// Replace substring in argument with slice of docker options
+			argsWithDockerArgs = append(
+				argsWithDockerArgs,
+				strings.Replace(arg, DockerArgsMagic, strings.Join(dockerArgs, " "), -1),
+			)
+			continue
+		}
+
+		argsWithDockerArgs = append(argsWithDockerArgs, arg)
+	}
+	ac.Args = argsWithDockerArgs
+
 	var e []string
 	for k, v := range env {
 		e = append(e, fmt.Sprintf("%s=%s", k, v))
 	}
 
-	return runSubcommand(ac.Args, append(os.Environ(), e...))
+	return runSubcommand(
+		ac.Args,
+		append(os.Environ(), e...),
+		ac.StdIn,
+		ac.StdOut,
+		ac.StdErr,
+	)
 }
 
 // formatForEnv returns a string in %k=%v format, where %k=namespace of the secret and
@@ -200,6 +250,10 @@ func joinEnv(env map[string]string) string {
 	for k, v := range env {
 		envs = append(envs, fmt.Sprintf("%s=%s", k, v))
 	}
+
+	// Sort to ensure predictable results
+	sort.Strings(envs)
+
 	return strings.Join(envs, "\n") + "\n"
 }
 
@@ -240,20 +294,20 @@ func findInParentTree(secretsFile string, leafDir string) (string, error) {
 	}
 }
 
-// scans arguments for the magic string; if found,
+// scans arguments for the envfile magic string; if found,
 // creates a tempfile to which all the environment mappings are dumped
 // and replaces the magic string with its path.
 // Returns the path if so, returns an empty string otherwise.
 func setupEnvFile(args []string, env map[string]string, tempFactory *TempFactory) string {
 	var envFile = ""
 
 	for i, arg := range args {
-		idx := strings.Index(arg, ENV_FILE_MAGIC)
+		idx := strings.Index(arg, EnvFileMagic)
 		if idx >= 0 {
 			if envFile == "" {
 				envFile = tempFactory.Push(joinEnv(env))
 			}
-			args[i] = strings.Replace(arg, ENV_FILE_MAGIC, envFile, -1)
+			args[i] = strings.Replace(arg, EnvFileMagic, envFile, -1)
 		}
 	}