bindings: fix handling of env secrets in remote builds #27602

ZuhairM7 · 2025-11-25T05:39:56Z

Previously, using --secret=id=foo,env=BAR in remote mode would fail because the client sent the env var name to the server, which tried to resolve it locally. This patch modifies the client to resolve the environment variable locally, write it to a temp file, and send it as a file-based secret.

This aligns Podman's remote behavior with Docker's behavior and ensures secrets are correctly passed to the build container.

Test to verify fix:
export MYSECRET='qwerty' podman build --secret=id=mysecret,env=MYSECRET -f - . <<EOF FROM alpine RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret EOF

Before (Remote Client): The secret is empty because the server cannot find MYSECRET in its environment.
STEP 1/2: FROM alpine STEP 2/2: RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret COMMIT --> 256d6061a45d

After (Remote Client): The client resolves MYSECRET to qwerty and sends it to the server.
STEP 1/2: FROM alpine STEP 2/2: RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret qwerty COMMIT --> d5c40b8863ce

Fixes #27494

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
the sign-off email address. See CONTRIBUTING.md
for more information.
Referenced issues using Fixes: #00000 in commit message (if applicable)
Tests have been added/updated (or no tests are needed)
Documentation has been updated (or no documentation changes are needed)
All commits pass make validatepr (format/lint checks)
Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

Fixed an issue where `podman build --secret ... env=VAR` failed in remote mode (e.g., macOS) by correctly resolving environment variables on the client side.

packit-as-a-service · 2025-11-25T06:13:48Z

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

lsm5

@ZuhairM7 thanks for the PR.

For fixing the DCO job, you'll need to signoff on your commit.
Please also check out the Validate source code changes job failure. That needs to get fixed to get the other jobs moving.

Can you also add a test?

mheon · 2025-11-25T15:51:31Z

pkg/bindings/images/build.go

+					// read specified env into a tmp file
+					// move tmp file to tar and change secret source to relative tmp file
+					secretVal := os.Getenv(val)
+					tmpSecretFilePath, err := tempManager.CreateTempFileFromReader(contextDir, "podman-build-secret-*", strings.NewReader(secretVal))


Looks like this could leak - a defer os.Remove(...) after the error check would fix that

Cleanup is handled by TempFileManager.

Honny1

Thanks, it looks good, except for the thing the others mentioned. I fixed the release notes in the PR description.

Honny1 · 2025-11-26T10:35:35Z

pkg/bindings/images/build.go

+					// read specified env into a tmp file
+					// move tmp file to tar and change secret source to relative tmp file
+					secretVal := os.Getenv(val)
+					tmpSecretFilePath, err := tempManager.CreateTempFileFromReader(contextDir, "podman-build-secret-*", strings.NewReader(secretVal))


Cleanup is handled by TempFileManager.

ninja-quokka

Thanks for your first patch!

It looks good to me and I would approve it once a test is added like @lsm5 mentioned, test/e2e/build_test.go looks like a good place to me.

This function could do with a refactor some time in the future.

Honny1 · 2025-12-01T09:26:53Z

test/e2e/build_test.go

+	It("podman build with a secret from env", func() {
+		os.Setenv("MYSECRET", "somesecret")
+		defer os.Unsetenv("MYSECRET")
+		session := podmanTest.Podman([]string{"build", "-f", "build/Containerfile.with-secret", "-t", "secret-test", "--secret", "id=mysecret,env=MYSECRET", "build/"})


Use podmanTest.PodmanExitCleanly to simplify waiting and exit code verification.

Honny1 · 2025-12-01T09:27:01Z

test/e2e/build_test.go

+		Expect(session).Should(ExitCleanly())
+		Expect(session.OutputToString()).To(ContainSubstring("somesecret"))
+
+		session = podmanTest.Podman([]string{"rmi", "secret-test"})


Previously, using --secret=id=foo,env=BAR in remote mode would fail because the client sent the env var name to the server, which tried to resolve it locally. This patch modifies the client to resolve the environment variable locally, write it to a temp file, and send it as a file-based secret. Fixes containers#27494 Signed-off-by: ZuhairM7 <ZuhairM7> Signed-off-by: ZuhairM7 <zuhairmerali@gmail.com>

ninja-quokka

/lgtm

ninja-quokka · 2025-12-02T22:33:25Z

test/e2e/build_test.go


+	It("podman build with a secret from env", func() {
+		os.Setenv("MYSECRET", "somesecret")
+		defer os.Unsetenv("MYSECRET")


Nice, we do unset some env vars on every test but not this one so it's good to unset it.

podman/test/e2e/common_test.go

Lines 137 to 139 in 4eaff6f

os.Unsetenv("CONTAINERS_CONF")

os.Unsetenv("CONTAINERS_CONF_OVERRIDE")

os.Unsetenv("PODMAN_CONNECTIONS_CONF")

packit-as-a-service · 2025-12-03T13:46:45Z

Cockpit tests failed for commit fdbb696. @martinpitt, @jelly, @mvollmer please check.

ninja-quokka · 2025-12-04T11:30:34Z

Hey @containers/podman-maintainers , could you please take a look at this one when you get a chance. Not sure about the failing testfarm test, looks unrelated to me.

Honny1

LGTM. I reran the failed Packit tests.

Honny1

LGTM

openshift-ci · 2025-12-04T13:10:15Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Honny1, ninja-quokka, ZuhairM7

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Honny1]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Fryguy · 2025-12-04T15:37:29Z

Does this fix #17382 ?

Honny1 · 2025-12-04T15:42:11Z

I think so, I will check that.

openshift-ci bot added the do-not-merge/release-note-label-needed Enforce release-note requirement, even if just None label Nov 25, 2025

lsm5 reviewed Nov 25, 2025

View reviewed changes

mheon reviewed Nov 25, 2025

View reviewed changes

Honny1 reviewed Nov 26, 2025

View reviewed changes

openshift-ci bot added release-note and removed do-not-merge/release-note-label-needed Enforce release-note requirement, even if just None labels Nov 26, 2025

ninja-quokka reviewed Nov 27, 2025

View reviewed changes

ZuhairM7 force-pushed the fix-remote-build-secrets branch 2 times, most recently from b90a1e5 to 7de97be Compare November 30, 2025 02:43

Honny1 reviewed Dec 1, 2025

View reviewed changes

ZuhairM7 force-pushed the fix-remote-build-secrets branch from 7de97be to fdbb696 Compare December 2, 2025 22:21

ninja-quokka approved these changes Dec 2, 2025

View reviewed changes

openshift-ci bot assigned ninja-quokka Dec 2, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 2, 2025

Honny1 reviewed Dec 4, 2025

View reviewed changes

Honny1 approved these changes Dec 4, 2025

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 4, 2025

openshift-merge-bot bot merged commit 0bd2b4b into containers:main Dec 4, 2025
82 checks passed

Luap99 mentioned this pull request Dec 4, 2025

Add note that build secrets do not work on macOS and Windows #27682

Closed

6 tasks

mheon mentioned this pull request Dec 4, 2025

[Bug]: podman build --secrets with environment variables does not work on MacOS #17382

Closed

	os.Unsetenv("CONTAINERS_CONF")
	os.Unsetenv("CONTAINERS_CONF_OVERRIDE")
	os.Unsetenv("PODMAN_CONNECTIONS_CONF")

bindings: fix handling of env secrets in remote builds #27602

bindings: fix handling of env secrets in remote builds #27602

Conversation

ZuhairM7 commented Nov 25, 2025 • edited by Honny1 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Does this PR introduce a user-facing change?

Uh oh!

packit-as-a-service bot commented Nov 25, 2025

Uh oh!

lsm5 left a comment

Choose a reason for hiding this comment

Uh oh!

mheon Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

Honny1 Nov 26, 2025

Choose a reason for hiding this comment

Uh oh!

Honny1 left a comment

Choose a reason for hiding this comment

Uh oh!

Honny1 Nov 26, 2025

Choose a reason for hiding this comment

Uh oh!

ninja-quokka left a comment

Choose a reason for hiding this comment

Uh oh!

Honny1 Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

Honny1 Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

ninja-quokka left a comment

Choose a reason for hiding this comment

Uh oh!

ninja-quokka Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

packit-as-a-service bot commented Dec 3, 2025

Uh oh!

ninja-quokka commented Dec 4, 2025

Uh oh!

Honny1 left a comment

Choose a reason for hiding this comment

Uh oh!

Honny1 left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Dec 4, 2025

Uh oh!

Uh oh!

Fryguy commented Dec 4, 2025

Uh oh!

Honny1 commented Dec 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

ZuhairM7 commented Nov 25, 2025 •

edited by Honny1

Loading