Docker Compose deployment silently materializes blank env values for Azure resource outputs used by existing Key Vault references
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 991
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 196
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
When deploying an Aspire app to Docker Compose, a referenced existing Azure Key Vault resource produces unresolved/blank environment values in the generated deployment artifacts.
In my case:
- AppHost uses `AddAzureKeyVault("key-vault")`
- the vault is configured with `RunAsExisting(...)` and `PublishAsExisting(...)`
- app resources use `.WithReference(keyVaultResource)`
- Docker Compose output contains:
```yaml
ConnectionStrings__key-vault: "${KEY_VAULT_OUTPUTS_VAULTURI}"
KEY_VAULT_URI: "${KEY_VAULT_OUTPUTS_VAULTURI}"
```
But the prepared environment file deployed to the host contains:
KEY_VAULT_OUTPUTS_VAULTURI=
The deployment succeeds without warning, so the containers start without the Key Vault URI.
### Expected Behavior
Docker Compose deployment resolves the Key Vault URI output before writing the prepared env file, or Aspire fails/warns clearly that this output cannot be materialized for the Docker Compose target and should be supplied explicitly.
### Steps To Reproduce
I have prepared a repro https://github.com/tjackadams/aspire-keyvault-compose-repro
### Exceptions (if any)
_No response_
### Aspire doctor output
```
❯ aspire doctor
Aspire Environment Check
========================
.NET SDK
✅ .NET 10.0.300 installed (x64)
Container Runtime
✅ Docker v29.1.3: running (auto-detected (default)) ← active
Environment
✅ HTTPS development certificate is trusted
⚠️ HTTPS development certificate has an older version (v5, v4)
Run 'aspire certs clean' to remove all certificates, then run 'aspire certs trust' to create and trust a new one.
See: https://aka.ms/aspire-prerequisites#dev-certs
Details:
Older certificate versions (< v4) may not support all certificate trust scenarios.
Summary: 3 passed, 1 warnings, 0 failed
For detailed prerequisites: https://aka.ms/aspire-prerequisites
```
### Anything else?
discovered while trying to deploy a container that references an existing key vault resource.
https://github.com/davidfowl/aspire-ssh-deploy
Contributor guide
Assessment
This issue has not been assessed yet.