Escape $ in generated Docker Compose files - #5087
Conversation
锔忊渽 There are no secrets present in this pull request anymore.If these secrets were true positive and are still valid, we highly recommend you to revoke them. 馃 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request. |
|
|
Json-Andriopoulos
left a comment
Json-Andriopoulos
left a comment
There was a problem hiding this comment.
Thanks for this PR @kounelisagis . I added some minor comments, feel free to address them at your own pace and ping me to approve & merge.
Json-Andriopoulos
added
the
no-release-notes
|
@kounelisagis One last thing: To fix the failing lint checks you can do the following: |
Docker Compose interpolates $VAR and ${VAR} across the whole compose
file before creating containers. Both the SSH and HyperAI orchestrators
write already resolved step environments (secrets included) and bind
mount paths straight into the file, so any value containing $ was
silently mangled, had host environment values injected into it, or, for
forms like ${X:?}, aborted `docker compose up` and the whole run.
Route both orchestrators through a shared dump_compose_yaml helper that
escapes every $ as $$ on the serialized document, so every value round
trips verbatim. This mirrors what compose-go's own serializer emits and
is the only complete fix: the escape must cover the entire file, not
just the environment block (mount paths are affected too), and Compose
offers no --no-interpolate at `up` time.
609403a to
3b7bf5b
Compare
Docker Compose interpolates $VAR and ${VAR} across the whole compose
file before creating containers. Both the SSH and HyperAI orchestrators
write already resolved step environments (secrets included) and bind
mount paths straight into the file, so any value containing $ was
silently mangled, had host environment values injected into it, or, for
forms like ${X:?}, aborted `docker compose up` and the whole run.
Route both orchestrators through a shared dump_compose_yaml helper that
escapes every $ as $$ on the serialized document, so every value round
trips verbatim. This mirrors what compose-go's own serializer emits and
is the only complete fix: the escape must cover the entire file, not
just the environment block (mount paths are affected too), and Compose
offers no --no-interpolate at `up` time.
Co-authored-by: Json-Andriopoulos <Json-Andriopoulos@users.noreply.github.com>
3 participants
Docker Compose interpolates
$VARand${VAR}across the whole compose file before starting containers. The SSH and HyperAI orchestrators write already resolved step environments (secrets included) and bind mount paths straight into the file, so any value containing$was corrupted: apa$$wordsecret reached the container aspa$word, host environment values leaked in, and values shaped like${X:?}aborteddocker compose upand the whole run.Both orchestrators now serialize through a shared
dump_compose_yamlhelper that escapes every$as$$, so values round trip verbatim. The escape covers the whole document because mount paths are affected too, not only the environment block.Tests: helper round trip, plus an SSH regression asserting values containing
$survive.