Remove private docker registry credentials from Spring Boot POM file - spring-boot

Question

I want to create docker images with CI/CD (Jenkins) of my spring boot application and push the image to a private nexus docker registry.
How to avoid adding my docker credentials to POM file and have them in GIT? Where should I pass/place the credentials instead?
Or should I just push the image manually in jenkins with docker login, docker push?
I followed this tutorial (https://docs.spring.io/spring-boot/docs/2.4.0/maven-plugin/reference/htmlsingle/#build-image-example-publish) and my POM looks like this:
<project>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<configuration>
<image>
<name>docker.example.com/library/${project.artifactId}</name>
<publish>true</publish>
</image>
<docker>
<publishRegistry>
<username>user</username>
<password>secret</password>
<url>https://docker.example.com/v1/</url>
<email>user#example.com</email>
</publishRegistry>
</docker>
</configuration>
</plugin>
</plugins>
</build>
</project>

Answer 1

You could use variables in your POM and pass them when calling maven. You should store the credentials in jenkins credentials manager
e.g.:
...
<properties>
<DOCKER_REGISTRY/>
<DOCKER_REGISTRY_USER/>
<DOCKER_REGISTRY_PASSWORD/>
<DOCKER_IMAGE_NAME>${DOCKER_REGISTRY}/${project.artifactId}:${project.version}</DOCKER_IMAGE_NAME>
</properties>
...
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<configuration>
<image>
<name>${DOCKER_IMAGE_NAME}</name>
<publish>true</publish>
</image>
<docker>
<publishRegistry>
<username>${DOCKER_REGISTRY_USER}</username>
<password>${DOCKER_REGISTRY_PASSWORD}</password>
<url>${DOCKER_REGISTRY}</url>
</publishRegistry>
</docker>
</configuration>
</plugin>
...
Then you could call maven like this in your jenkins pipeline:
stage('Build Docker Image') {
steps {
withCredentials([usernamePassword(credentialsId: 'YOUR_CREDENTIALS_ID', passwordVariable: 'NEXUS_PASSWORD', usernameVariable: 'NEXUS_USER')]) {
sh "mvn -DskipTests=true spring-boot:build-image -DDOCKER_REGISTRY=SUBDOMAIN.DOMAIN.COM -DDOCKER_REGISTRY_USER=$NEXUS_USER -DDOCKER_REGISTRY_PASSWORD=$NEXUS_PASSWORD"
}
}
}

Answer 2

You can store the credentials using Jenkins credential manager, and set them up in your mvn build command via -D parameters