Propagate pip index url to container build stages that require it

tools/ci_build/github/azure-pipelines/stages/nuget-linux-cuda-packaging-stage.yml

@@ -95,6 +95,7 @@ stages:
         DockerBuildArgs: "
           --build-arg TRT_VERSION=${{ variables.linux_trt_version }}
           --build-arg BUILD_UID=$( id -u )
+          --secret id=PIP_INDEX_URL
           "
         Repository: onnxruntimecuda${{ variables.CUDA_VERSION_MAJOR }}xtrt86build
     - template: ../templates/set-version-number-variables-step.yml
@@ -160,7 +161,7 @@ stages:
         ScriptName: $(Build.SourcesDirectory)/onnxruntime/tools/ci_build/get_docker_image.py
         Dockerfile: $(Build.SourcesDirectory)/onnxruntime/tools/ci_build/github/linux/docker/inference/x86_64/default/cuda${{ variables.CUDA_VERSION_MAJOR }}/Dockerfile
         Context: $(Build.SourcesDirectory)/onnxruntime/tools/ci_build/github/linux/docker/inference/x86_64/default/cuda${{ variables.CUDA_VERSION_MAJOR }}
-        DockerBuildArgs: "--build-arg TRT_VERSION=${{ variables.linux_trt_version }} --build-arg BUILD_UID=$( id -u )"
+        DockerBuildArgs: "--build-arg TRT_VERSION=${{ variables.linux_trt_version }} --build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL"
         Repository: onnxruntimecuda${{ variables.CUDA_VERSION_MAJOR }}xtrt86build
 
     - template: ../templates/set-version-number-variables-step.yml

tools/ci_build/github/azure-pipelines/templates/c-api-linux-cpu.yml

@@ -57,15 +57,15 @@ jobs:
       parameters:
         Dockerfile: tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile
         Context: tools/ci_build/github/linux/docker/inference/x86_64/default/cpu
-        DockerBuildArgs: "--build-arg BUILD_UID=$( id -u )"
+        DockerBuildArgs: "--build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL"
         Repository: onnxruntimecpubuildcentos8${{parameters.OnnxruntimeArch}}_packaging
 
   - ${{ if eq(parameters.OnnxruntimeArch, 'aarch64') }}:
     - template: get-docker-image-steps.yml
       parameters:
         Dockerfile: tools/ci_build/github/linux/docker/inference/aarch64/default/cpu/Dockerfile
         Context: tools/ci_build/github/linux/docker/inference/aarch64/default/cpu
-        DockerBuildArgs: "--build-arg BUILD_UID=$( id -u )"
+        DockerBuildArgs: "--build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL"
         Repository: onnxruntimecpubuildcentos8${{parameters.OnnxruntimeArch}}_packaging
 
   - task: CmdLine@2

tools/ci_build/github/azure-pipelines/templates/get-docker-image-steps.yml

@@ -65,6 +65,8 @@ steps:
             --container-registry onnxruntimebuildcache \
             --repository "${{ parameters.Repository }}"
         displayName: "Get ${{ parameters.Repository }} image for ${{ parameters.Dockerfile }}"
+        env:
+          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
       ContainerRegistry: onnxruntimebuildcache
 - ${{ if eq(parameters.UseImageCacheContainerRegistry, false) }}:
   # the difference is no --container-registry
@@ -78,6 +80,8 @@ steps:
             --docker-build-args "${{ parameters.DockerBuildArgs }}" \
             --repository "${{ parameters.Repository }}"
         displayName: "Get ${{ parameters.Repository }} image for ${{ parameters.Dockerfile }}"
+        env:
+          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
       ContainerRegistry: onnxruntimebuildcache
 
 - script: |
@@ -86,4 +90,3 @@ steps:
     docker system df
     df -h
   displayName: Check Docker Images
-

tools/ci_build/github/azure-pipelines/templates/py-linux.yml

@@ -59,6 +59,8 @@ jobs:
       artifactName: drop-linux-cpu-${{ parameters.arch }}-${{ parameters.ep }}
 
   variables:
+  - name: SYSTEM_ACCESSTOKEN
+    value: $(System.AccessToken)
   - name: extra_build_args
     ${{ if ne(parameters.extra_build_arg, '') }}:
       value: '-x "${{ parameters.extra_build_arg }}"'
@@ -84,7 +86,7 @@ jobs:
     parameters:
       Dockerfile: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu/Dockerfile
       Context: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu
-      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u )"
+      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL --secret id=CARGO_CONFIG,src=$HOME/.cargo/config.toml --secret id=SYSTEM_ACCESSTOKEN"
       Repository: onnxruntimecpubuildpython${{ parameters.arch }}
 
   - task: Bash@3

tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml

@@ -37,6 +37,7 @@ jobs:
   timeoutInMinutes: ${{ parameters.timeout }}
   variables:
     skipComponentGovernanceDetection: true
+    SYSTEM_ACCESSTOKEN: $(System.AccessToken)
   workspace:
     clean: all
   pool: ${{ parameters.machine_pool }}
@@ -64,7 +65,7 @@ jobs:
     parameters:
       Dockerfile: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu/Dockerfile
       Context: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu
-      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u )"
+      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL --secret id=CARGO_CONFIG,src=$HOME/.cargo/config.toml --secret id=SYSTEM_ACCESSTOKEN"
       Repository: onnxruntimecpubuildpython${{ parameters.arch }}
 
   - task: Bash@3

tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile

@@ -2,7 +2,13 @@ ARG BASEIMAGE=onnxruntimebuildcache.azurecr.io/internal/azureml/onnxruntime/buil
 FROM $BASEIMAGE
 
 ADD scripts /tmp/scripts
-RUN cd /tmp/scripts && /tmp/scripts/install_centos.sh && /tmp/scripts/install_deps.sh && rm -rf /tmp/scripts
+RUN --mount=type=secret,id=PIP_INDEX_URL,required=false \
+    --mount=type=secret,id=CARGO_CONFIG,required=false \
+    --mount=type=secret,id=SYSTEM_ACCESSTOKEN,required=false \
+    if [ -f /run/secrets/PIP_INDEX_URL ]; then export PIP_INDEX_URL=$(cat /run/secrets/PIP_INDEX_URL); fi && \
+    if [ -f /run/secrets/CARGO_CONFIG ]; then mkdir -p /.cargo && cp /run/secrets/CARGO_CONFIG /.cargo/config.toml; fi && \
+    if [ -f /run/secrets/SYSTEM_ACCESSTOKEN ]; then export CARGO_REGISTRIES_ONNXRUNTIME_TOKEN="Basic $(printf ':%s' "$(cat /run/secrets/SYSTEM_ACCESSTOKEN)" | base64 -w0)"; fi && \
+    cd /tmp/scripts && /tmp/scripts/install_centos.sh && /tmp/scripts/install_deps.sh && rm -rf /tmp/scripts
 
 ARG BUILD_UID=1001
 ARG BUILD_USER=onnxruntimedev

tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile

@@ -8,7 +8,10 @@ FROM $BASEIMAGE
 ENV LANG=en_US.UTF-8
 ENV LC_ALL=en_US.UTF-8
 
-RUN python3 -m pip install flatbuffers
+ADD scripts /tmp/scripts
+RUN --mount=type=secret,id=PIP_INDEX_URL,required=false \
+    if [ -f /run/secrets/PIP_INDEX_URL ]; then export PIP_INDEX_URL=$(cat /run/secrets/PIP_INDEX_URL); fi && \
+    python3 -m pip install flatbuffers
 
 ARG BUILD_UID=1001
 ARG BUILD_USER=onnxruntimedev