Docker publish ports during build

Question

I'm using Docker to build an nginx enviornment. I'm wondering if it's possible to expose to publish the ports (80, 443) during build so letsencrypt can run at build time (it needs network access to a server in the (intermediate) container).

Is this possible?

Answer 1

I have never seen that and i think that is not possible by design.

• You should not place the secret key in the image
• You might need to re-assure the license after 2 months and would need to rebuild the whole image

in general, this is done using a companion letsencrypt docker image, sometimes called sidekick. You basically have your app (and its containers) and a letsencrypt container, exposing a volume which nginx then mounts using volume_from this volume is were the letsencrypt container puts the fetched certificates. This happens during image-startup, not during image creation. You use a docker-compose file to configure anything needed.

E.g. you can have a look here a) https://github.com/rancher/community-catalog/blob/master/templates/letsencrypt/2/docker-compose.yml b) or http://letsencrypt.readthedocs.io/en/latest/using.html#running-with-docker

a) lets you defined the domains you are going to need using ENV variables, which will suite a docker-compose way very well, not providing any files like a configuration on the host ( keeps it portable ).

You can still put all this on the nginx-server, but its just not best practise, out of many reasons ( e.g. the need to configure nginx ).

---

If you want to stick to "build time", an alternative is using the DNS verify mode, so instead of verifying using connect-back on a port, you rather verify using a DNS-entry, some links for that - https://github.com/lukas2511/letsencrypt.sh/wiki/Examples-for-DNS-01-hooks - the a) container does this

For this scenario you might want to pick http://cloudflare.com - AFAIK it is the only DNS service with free API access for unlimited domains, anything else either costs money or has limits.