containers / containers/podman-compose
external build secrets generate incorrect `--secret` flag for `podman build`
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 622
- PR merge metrics
- No merged PRs in 30d
Description
**Tools:**
- `podman` 5.8.2
- `podman-compose` 1.5.0
**Related issues:** [#1066](https://github.com/containers/podman-compose/issues/1066), [#589](https://github.com/containers/podman-compose/issues/589)
## Description
When a secret is declared as `external: true` in `compose.yml` and referenced in a service `build.secrets`, `podman-compose` passes it to `podman build` as:
```
--secret WEOTF_ARTIF_TOKEN
```
But `podman build` requires the `id=` prefix:
```
--secret id=WEOTF_ARTIF_TOKEN
```
This results in:
```
Error: creating build executor: incorrect secret flag format: should be --secret id=foo,src=bar[,env=ENV][,type=file|env]
```
## Minimal reproducer
```yaml
secrets:
MY_TOKEN:
external: true
services:
myapp:
build:
secrets:
- source: MY_TOKEN
```
```bash
echo -n "somevalue" | podman secret create MY_TOKEN -
podman-compose build myapp
# Error: creating build executor: incorrect secret flag format
```
## Workaround
Name the secret `"id=MY_TOKEN"` in the compose file (both in the top-level `secrets` block and the `source` reference), and create the podman secret under that literal name:
```yaml
secrets:
"id=MY_TOKEN":
external: true
services:
myapp:
build:
secrets:
- source: "id=MY_TOKEN"
```
```bash
echo -n "$MY_TOKEN" | podman secret create "MY_TOKEN" -
```
This exploits the bug: podman-compose emits `--secret id=MY_TOKEN`, which `podman build` then correctly parses.
EDIT: fix `podman secret create` command in the workaround.
Contributor guide
Assessment
This issue has not been assessed yet.