Support file-based secrets in provider extensions - #14186
Open
NAVEENKUMARKR777 wants to merge 1 commit into
Open
Support file-based secrets in provider extensions#14186NAVEENKUMARKR777 wants to merge 1 commit into
NAVEENKUMARKR777 wants to merge 1 commit into
Conversation
Provider extensions can currently only inject environment variables into dependent services (setenv/rawsetenv), but credentials are often better delivered as mounted files than env vars, which can leak through process inspection, debugging output, logs and crash reports. Add two new provider protocol messages, setsecret and rawsetsecret, mirroring setenv/rawsetenv: a provider can now hand a dependent service a secret whose content is mounted at /run/secrets/<name>, without the compose file declaring it. Also fixes a latent bug in buildContainerSecretMounts: a secret with Content set (no File) was not skipped before building a bind mount, so it would bind-mount the process's current working directory into the container. Provider-contributed secrets are content-based, so this fix is required for the new feature to behave correctly. Closes docker#14163 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Naveenkumar <naveenkumarkr555@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
setenv/rawsetenv). Credentials are often better delivered as mounted files than env vars, which can leak through process inspection, debugging output, logs and crash reports.setsecretandrawsetsecret, mirroringsetenv/rawsetenv: a provider can hand a dependent service a secret whose content is mounted at/run/secrets/<name>, without the compose file declaring it up front.buildContainerSecretMounts: a secret withContentset (noFile) wasn't skipped before building a bind mount, so it would bind-mount the process's working directory into the container. Provider-contributed secrets are content-based, so this fix is required for the new feature to behave correctly.docs/extension.mdand extends the example provider (docs/examples/provider.go) to emit them.Test plan
go test ./pkg/compose/...— new unit tests for message parsing (TestExecutePlugin_ParsesSecretMessages) and the merge/dedup logic (TestUpsertProviderSecret)golangci-lint run --build-tags e2e ./...— 0 issuesTestProviderSetSecret,TestProviderRawSetSecretOverridesUserSecret) added but not run in this environment — no Docker daemon available. Please rungo test -tags e2e ./pkg/e2e/ -run TestProviderSetSecret/TestProviderRawSetSecretOverridesUserSecretbefore merging.Closes #14163
🤖 Generated with Claude Code