I've set up a Docker container that builds and executes a web application. That container gets built on a CI as a service, then pushed to a private Docker registry to be run from my servers.
I want the assets built inside the container to be uploaded to a CDN. I've written a basic script that accomplishes this, but I'm not sure conceptually where it belongs. Should it go in the Docker build? That means I need to pass in my CDN key/secret/URL/other data as args to the container. I feel like that could quickly get unwieldy (though perhaps not as part of a docker-compose config). It also means I can't easily rerun the upload (since that layer will be cached).
On the other hand, if I'm going to run the upload script as a build step in my CI, I'll need to retrieve the built files from within the container (as a mounted volume, maybe?) which doesn't seem quite right to me either.
Where does a CDN upload build step belong?