containers / containers/podman-compose

Path to external secret gets passed to environment variable instead of the secret itself

Open
#760 10 comments 3 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
6.2k
Forks
622
PR merge metrics
No merged PRs in 30d

Description

My goal is to not store my passwords in any file or exposed environment variable when managing containers, only relying on podman secrets.

I created a secret manually by passing a password to stdin, like `printf "somepassword" | podman secret create passname -`.

I then added the secret to my wg-easy container and marked it as external.

I passed the path to said secret via an environment variable: `PASSWORD=/run/secrets/passname`.

However, the actual password I get for wg-easy is simply `/run/secrets/passname` instead of the created secret, as though it was considered a string.

Using podman-compose from the devel archive did not solve the issue.

**To Reproduce**
Steps to reproduce the behavior:
1. what is the content of the current working directory (ex. `docker-compose.yml`, `.env`, `Dockerfile`, ...etc.)

Only a compose file. I also use Caddy which requires more files, but the issue is reproducible without those.

2. what is the sequence of commands you typed

`podman-compose --in-pod 1 --project-name wg-easy up --detach`

Minimal reproducible example without Caddy, see https://github.com/wg-easy/wg-easy/wiki/Using-WireGuard-Easy-with-Podman for a reference:

```
version: "3.8"

volumes:
wg-easy:

secrets:
wg-pass:
external: true

services:
wg-easy:
environment:
- WG_HOST=my.domain.com
- PASSWORD=/run/secrets/wg-pass
secrets:
- wg-pass
image: docker.io/weejewel/wg-easy
container_name: wg-easy
hostname: wg-easy
volumes:
- wg-easy:/etc/wireguard:Z
ports:
- 51820:51820/udp
- 51821:51821/tcp
restart: unless-stopped
cap_add:
- NET_ADMIN
- NET_RAW
- SYS_MODULE
sysctls:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.src_valid_mark=1
```

The web interface where you type the password should be in port 51821.

**Expected behavior**
The password required to log in to wg-easy is the one stored in the secret.

**Actual behavior**
The password required to log in to wg-easy is literally "/run/secrets/wg-pass".

**Environment:**
- OS: Linux
- podman version: 4.4.1
- podman compose version: 1.0.6

**Additional context**

I only found two potentially related issues, but I don't really know if they are what I mention in this issue:

* https://github.com/containers/podman-compose/issues/671
* https://github.com/containers/podman-compose/issues/589

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.