715a154f-c769-440d-9dad-373a1d7efafe

Please see our docs on this topic -

But it’s considered unsafe to use secrets as ARG to Dockerfile?

Not as far as I know.

https://docs.docker.com/build/building/secrets/

We only support ARG

This is what I meant to send https://docs.docker.com/reference/build-checks/secrets-used-in-arg-or-env/

^

This is a non-issue because the images do not leave our private registry.

It is an issue, also because there way too many of them to pass them one by one to the Dockerfile.

Do I have any other options here?

Are Railway’s VMs stateful, so I can maybe do the collectstatic stage at runtime?

You only need to pass in the variables that you need during build; all variables are automatically injected at runtime.

We don't use VMs at this time, but to persist files, you would need to store the files in a volume.

There are way too many of them in the case of Django which needs to import the settings.py file to do the collectstatic stage, which includes both secrets and regular ENV vars.

Then you can try running that command at runtime.

Yeah, that fits what Railway does here:

https://github.com/railwayapp-templates/django/blob/main/railway.json

That sucks quite a bit since it will affect startup time, but I’ll try it I guess and see how bad it is.

I hope these issues raised here are propogated up, I’m really bummed I can’t use my Dockerfile as is with Railway and it makes me want to consider other alternatives to move to from Heroku.

Thanks for your help @Brody.

It will effect startup time, but that would be a non-issue as long as you aren't using a volume and as long as you are using health checks.

!s