containers / containers/podman-compose

podman-compose build does not support environment type secrets

Open
#1,066 11 comments 36 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
6.2k
Forks
622
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
When using `podman-compose build` it errors out on having any secrets defines as `environment:`. This is supported in the [compose spec](https://github.com/compose-spec/compose-spec/blob/main/09-secrets.md#example-2)

**To Reproduce**
Steps to reproduce the behavior:
1. From the root of a repo create the following:
- test-image/Dockerfile
- docker-compose.yml

2. Contents of Dockerfile:
```
FROM redhat/ubi9:latest

RUN --mount=type=secret,id=proxy_username,target=/etc/yum/vars/proxy_username \
--mount=type=secret,id=proxy_token,target=/etc/yum/vars/proxy_token \
microdnf upgrade -y --nodocs && \
microdnf install -y --nodocs tar gzip
```

3. Contents of docker-compose.yml
```
version: "3.8"
services:
test-image:
build:
dockerfile: ./test-image/Dockerfile
secrets:
- proxy_username
- proxy_api_token
image: ${IMAGE_PATH:-test-image}:${IMAGE_TAG:-latest}
secrets:
proxy_api_token:
environment: PROXY_REGISTRY_API_TOKEN
proxy_username:
environment: PROXY_REGISTRY_USERNAME
```

4. Set the variables in your environment
```
export PROXY_REGISTRY_USERNAME="test-user"
export PROXY_REGISTRY_API_TOKEN="test-token"
```

5. Run podman-compose build
`podman-compose build test-image`

**Expected behavior**
podman-compose should have access to the environment variables set on the host/container it is running in and pass them along.

**Actual behavior**
podman-compose fails at parsing the yaml file.

**Output**

```
$ podman-compose -v
podman-compose version 1.2.0
podman version 4.9.4-rhel

$ podman-compose build test-image
Traceback (most recent call last):
File "/usr/local/bin/podman-compose", line 8, in
sys.exit(main())
File "/usr/local/lib/python3.9/site-packages/podman_compose.py", line 3504, in main
asyncio.run(async_main())
File "/usr/lib64/python3.9/asyncio/runners.py", line 44, in run
return loop.run_until_complete(main)
File "/usr/lib64/python3.9/asyncio/base_events.py", line 647, in run_until_complete
return future.result()
File "/usr/local/lib/python3.9/site-packages/podman_compose.py", line 3500, in async_main
await podman_compose.run()
File "/usr/local/lib/python3.9/site-packages/podman_compose.py", line 1743, in run
retcode = await cmd(self, args)
File "/usr/local/lib/python3.9/site-packages/podman_compose.py", line 2422, in compose_build
s = await t
File "/usr/lib64/python3.9/asyncio/tasks.py", line 611, in _wait_for_one
return f.result() # May raise f.exception().
File "/usr/local/lib/python3.9/site-packages/podman_compose.py", line 2376, in build_one
build_args.extend(get_secret_args(compose, cnt, secret, podman_is_building=True))
File "/usr/local/lib/python3.9/site-packages/podman_compose.py", line 646, in get_secret_args
raise ValueError(
ValueError: ERROR: unparsable secret: "proxy_api_token", service: "test-image"
```

**Environment:**
- OS: Linux
- podman version: 4.9.4-rhel
- podman compose version: 1.2.0

Contributor guide

Open the contributing guide

Research direction

Start in podman_compose.py at get_secret_args, called from compose_build/build_one, and reproduce the issue with the provided Dockerfile, docker-compose.yml, and environment variables. Done means podman-compose build accepts secrets defined with environment and passes the host values instead of raising the unparsable-secret error.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker-compose, python
Domain
build-system, cli, devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
66/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.