containers / containers/podman-compose

external build secrets generate incorrect `--secret` flag for `podman build`

Open
#1,461 0 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
6.2k
Forks
622
PR merge metrics
No merged PRs in 30d

Description

**Tools:**
- `podman` 5.8.2
- `podman-compose` 1.5.0

**Related issues:** [#1066](https://github.com/containers/podman-compose/issues/1066), [#589](https://github.com/containers/podman-compose/issues/589)

## Description

When a secret is declared as `external: true` in `compose.yml` and referenced in a service `build.secrets`, `podman-compose` passes it to `podman build` as:

```
--secret WEOTF_ARTIF_TOKEN
```

But `podman build` requires the `id=` prefix:

```
--secret id=WEOTF_ARTIF_TOKEN
```

This results in:

```
Error: creating build executor: incorrect secret flag format: should be --secret id=foo,src=bar[,env=ENV][,type=file|env]
```

## Minimal reproducer

```yaml
secrets:
MY_TOKEN:
external: true

services:
myapp:
build:
secrets:
- source: MY_TOKEN
```

```bash
echo -n "somevalue" | podman secret create MY_TOKEN -
podman-compose build myapp
# Error: creating build executor: incorrect secret flag format
```

## Workaround

Name the secret `"id=MY_TOKEN"` in the compose file (both in the top-level `secrets` block and the `source` reference), and create the podman secret under that literal name:

```yaml
secrets:
"id=MY_TOKEN":
external: true

services:
myapp:
build:
secrets:
- source: "id=MY_TOKEN"
```

```bash
echo -n "$MY_TOKEN" | podman secret create "MY_TOKEN" -
```

This exploits the bug: podman-compose emits `--secret id=MY_TOKEN`, which `podman build` then correctly parses.

EDIT: fix `podman secret create` command in the workaround.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.