containers · rhatdan · Apr 8, 2023 · Apr 1, 2023 · Apr 2, 2023 · TomSweeneyRedHat
diff --git a/cmd/buildah/run.go b/cmd/buildah/run.go
@@ -152,7 +152,6 @@ func runCmd(c *cobra.Command, args []string, iopts runInputOptions) error {
 		CNIConfigDir:     iopts.CNIConfigDir,
 		AddCapabilities:  iopts.capAdd,
 		DropCapabilities: iopts.capDrop,
-		Env:              iopts.env,
 		WorkingDir:       iopts.workingDir,
 	}
 
@@ -164,6 +163,8 @@ func runCmd(c *cobra.Command, args []string, iopts runInputOptions) error {
 		}
 	}
 
+	options.Env = buildahcli.LookupEnvVarReferences(iopts.env, os.Environ())
+
 	systemContext, err := parse.SystemContextFromOptions(c)
 	if err != nil {
 		return fmt.Errorf("building system context: %w", err)

diff --git a/imagebuildah/executor.go b/imagebuildah/executor.go
@@ -512,8 +512,7 @@ func (b *Executor) buildStage(ctx context.Context, cleanupStages map[int]*StageE
 				value := env[1]
 				envLine += fmt.Sprintf(" %q=%q", key, value)
 			} else {
-				value := os.Getenv(key)
-				envLine += fmt.Sprintf(" %q=%q", key, value)
+				return "", nil, fmt.Errorf("BUG: unresolved environment variable: %q", key)
 			}
 		}
 		if len(envLine) > 0 {

diff --git a/pkg/cli/build.go b/pkg/cli/build.go
@@ -372,7 +372,6 @@ func GenBuildOptions(c *cobra.Command, inputArgs []string, iopts BuildOptions) (
 		ContextDirectory:        contextDir,
 		Devices:                 iopts.Devices,
 		DropCapabilities:        iopts.CapDrop,
-		Envs:                    iopts.Envs,
 		Err:                     stderr,
 		Excludes:                excludes,
 		ForceRmIntermediateCtrs: iopts.ForceRm,
@@ -422,6 +421,9 @@ func GenBuildOptions(c *cobra.Command, inputArgs []string, iopts BuildOptions) (
 	if iopts.Quiet {
 		options.ReportWriter = io.Discard
 	}
+
+	options.Envs = LookupEnvVarReferences(iopts.Envs, os.Environ())
+
 	return options, containerfiles, removeAll, nil
 }
 

diff --git a/pkg/cli/common.go b/pkg/cli/common.go
@@ -484,3 +484,42 @@ func AliasFlags(f *pflag.FlagSet, name string) pflag.NormalizedName {
 	}
 	return pflag.NormalizedName(name)
 }
+
+// LookupEnvVarReferences returns a copy of specs with keys and values resolved
+// from environ. Strings are in "key=value" form, the same as [os.Environ].
+//
+//   - When a string in specs lacks "=", it is treated as a key and the value
+//     is retrieved from environ. When the key is missing from environ, neither
+//     the key nor value are returned.
+//
+//   - When a string in specs lacks "=" and ends with "*", it is treated as
+//     a key prefix and any keys with the same prefix in environ are returned.
+//
+//   - When a string in specs is exactly "*", all keys and values in environ
+//     are returned.
+func LookupEnvVarReferences(specs, environ []string) []string {
+	result := make([]string, 0, len(specs))
+
+	for _, spec := range specs {
+		if key, _, ok := strings.Cut(spec, "="); ok {
+			result = append(result, spec)
+
+		} else if key == "*" {
+			result = append(result, environ...)
+
+		} else {
+			prefix := key + "="
+			if strings.HasSuffix(key, "*") {
+				prefix = strings.TrimSuffix(key, "*")
+			}
+
+			for _, spec := range environ {
+				if strings.HasPrefix(spec, prefix) {
+					result = append(result, spec)
+				}
+			}
+		}
+	}
+
+	return result
+}
diff --git a/pkg/cli/common_test.go b/pkg/cli/common_test.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/containers/common/pkg/completion"
 	"github.com/spf13/pflag"
+	"github.com/stretchr/testify/assert"
 )
 
 func testFlagCompletion(t *testing.T, flags pflag.FlagSet, flagCompletions completion.FlagCompletions) {
@@ -59,3 +60,55 @@ func TestFromAndBudFlagsCompletions(t *testing.T) {
 	flagCompletions := GetFromAndBudFlagsCompletions()
 	testFlagCompletion(t, flags, flagCompletions)
 }
+
+func TestLookupEnvVarReferences(t *testing.T) {
+	t.Run("EmptyInput", func(t *testing.T) {
+		assert.Empty(t, LookupEnvVarReferences(nil, nil))
+		assert.Empty(t, LookupEnvVarReferences([]string{}, nil))
+	})
+
+	t.Run("EmptyEnvironment", func(t *testing.T) {
+		assert.Equal(t, []string{"a=b"}, LookupEnvVarReferences([]string{"a=b"}, nil))
+		assert.Equal(t, []string{"a="}, LookupEnvVarReferences([]string{"a="}, nil))
+		assert.Equal(t, []string{}, LookupEnvVarReferences([]string{"a"}, nil))
+		assert.Equal(t, []string{}, LookupEnvVarReferences([]string{"*"}, nil))
+	})
+
+	t.Run("MissingEnvironment", func(t *testing.T) {
+		assert.Equal(t,
+			[]string{"a=b", "c="},
+			LookupEnvVarReferences([]string{"a=b", "c="}, []string{"x=y"}))
+
+		assert.Equal(t,
+			[]string{"a=b"},
+			LookupEnvVarReferences([]string{"a=b", "c"}, []string{"x=y"}))
+
+		assert.Equal(t,
+			[]string{"a=b"},
+			LookupEnvVarReferences([]string{"a=b", "c*"}, []string{"x=y"}))
+	})
+
+	t.Run("MatchingEnvironment", func(t *testing.T) {
+		assert.Equal(t,
+			[]string{"a=b", "c="},
+			LookupEnvVarReferences([]string{"a=b", "c="}, []string{"c=d", "x=y"}))
+
+		assert.Equal(t,
+			[]string{"a=b", "c=d"},
+			LookupEnvVarReferences([]string{"a=b", "c"}, []string{"c=d", "x=y"}))
+
+		assert.Equal(t,
+			[]string{"a=b", "c=d"},
+			LookupEnvVarReferences([]string{"a=b", "c*"}, []string{"c=d", "x=y"}))
+
+		assert.Equal(t,
+			[]string{"a=b", "c=d", "cg=i"},
+			LookupEnvVarReferences([]string{"a=b", "c*"}, []string{"c=d", "x=y", "cg=i"}))
+	})
+
+	t.Run("MultipleMatches", func(t *testing.T) {
+		assert.Equal(t,
+			[]string{"a=b", "c=d", "cg=i", "c=d", "x=y", "cg=i", "cg=i"},
+			LookupEnvVarReferences([]string{"a=b", "c*", "*", "cg*"}, []string{"c=d", "x=y", "cg=i"}))
+	})
+}
diff --git a/tests/bud.bats b/tests/bud.bats
@@ -1633,6 +1633,12 @@ _EOF
   iid=$(cat ${TEST_SCRATCH_DIR}/output.iid)
   run_buildah inspect --format '{{.Docker.Config.Env}}' $iid
   expect_output "[]"
+
+  # Reference foo=baz from process environment
+  foo=baz run_buildah build --quiet=false --iidfile ${TEST_SCRATCH_DIR}/output.iid --env foo $WITH_POLICY_JSON -t ${target} $BUDFILES/from-scratch
+  iid=$(cat ${TEST_SCRATCH_DIR}/output.iid)
+  run_buildah inspect --format '{{.Docker.Config.Env}}' $iid
+  expect_output --substring "foo=baz"
 }
 
 @test "build with custom build output and output rootfs to directory" {

diff --git a/tests/run.bats b/tests/run.bats
@@ -234,12 +234,19 @@ function configure_and_check_user() {
 	run_buildah from --quiet --pull=false $WITH_POLICY_JSON alpine
 	cid=$output
 	run_buildah config --env foo=foo $cid
+
 	# Ensure foo=foo from `buildah config`
 	run_buildah run $cid -- /bin/sh -c 'echo $foo'
 	expect_output "foo"
+
 	# Ensure foo=bar from --env override
 	run_buildah run --env foo=bar $cid -- /bin/sh -c 'echo $foo'
 	expect_output "bar"
+
+	# Reference foo=baz from process environment
+	foo=baz run_buildah run --env foo $cid -- /bin/sh -c 'echo $foo'
+	expect_output "baz"
+
 	# Ensure that the --env override did not persist
 	run_buildah run $cid -- /bin/sh -c 'echo $foo'
 	expect_output "foo"