containers / containers/podman-compose
Path to external secret gets passed to environment variable instead of the secret itself
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 622
- PR merge metrics
- No merged PRs in 30d
Description
My goal is to not store my passwords in any file or exposed environment variable when managing containers, only relying on podman secrets.
I created a secret manually by passing a password to stdin, like `printf "somepassword" | podman secret create passname -`.
I then added the secret to my wg-easy container and marked it as external.
I passed the path to said secret via an environment variable: `PASSWORD=/run/secrets/passname`.
However, the actual password I get for wg-easy is simply `/run/secrets/passname` instead of the created secret, as though it was considered a string.
Using podman-compose from the devel archive did not solve the issue.
**To Reproduce**
Steps to reproduce the behavior:
1. what is the content of the current working directory (ex. `docker-compose.yml`, `.env`, `Dockerfile`, ...etc.)
Only a compose file. I also use Caddy which requires more files, but the issue is reproducible without those.
2. what is the sequence of commands you typed
`podman-compose --in-pod 1 --project-name wg-easy up --detach`
Minimal reproducible example without Caddy, see https://github.com/wg-easy/wg-easy/wiki/Using-WireGuard-Easy-with-Podman for a reference:
```
version: "3.8"
volumes:
wg-easy:
secrets:
wg-pass:
external: true
services:
wg-easy:
environment:
- WG_HOST=my.domain.com
- PASSWORD=/run/secrets/wg-pass
secrets:
- wg-pass
image: docker.io/weejewel/wg-easy
container_name: wg-easy
hostname: wg-easy
volumes:
- wg-easy:/etc/wireguard:Z
ports:
- 51820:51820/udp
- 51821:51821/tcp
restart: unless-stopped
cap_add:
- NET_ADMIN
- NET_RAW
- SYS_MODULE
sysctls:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.src_valid_mark=1
```
The web interface where you type the password should be in port 51821.
**Expected behavior**
The password required to log in to wg-easy is the one stored in the secret.
**Actual behavior**
The password required to log in to wg-easy is literally "/run/secrets/wg-pass".
**Environment:**
- OS: Linux
- podman version: 4.4.1
- podman compose version: 1.0.6
**Additional context**
I only found two potentially related issues, but I don't really know if they are what I mention in this issue:
* https://github.com/containers/podman-compose/issues/671
* https://github.com/containers/podman-compose/issues/589
Contributor guide
Assessment
This issue has not been assessed yet.