Source build secrets from .env files

[jamesgecko]

Description

In docker-compose.yml, runtime environment variables may be defined in .env files. But at build time, secrets can't be sourced from an .env file. They must be defined in an environment variable or in a dedicated text file on the host.

I'm using the following setup to try to mitigate the effect of any supply chain attacks on my development environment:

• 1Password's Environments feature, which locks access to an .env file behind an auth dialog.
• Visual Studio Code's dev containers plugin, which automatically runs docker compose build commands and doesn't allow passing alternate build arguments.

My choices for build secrets are currently:

• Load them into my host's environment
• Place them in individual files

Both leave them open to a malicious process on the host, and neither works with 1Password to give me an auth screen on access. It would be nice to be able to define a secret like this:

secrets:
  github_token:
    file: ./my_secrets.env
    key: GH_TOKEN

Then I would be prompted to grant access to the token automatically when VS Code sends docker compose a build command.

[ndeloof]

This is already supported: an environment-sourced build secret resolves against the environment Compose assembles, and that environment includes the project's .env file — the variable does not have to be set in the host environment.

services:
  app:
    build:
      context: .
      secrets: [github_token]

secrets:
  github_token:
    environment: GH_TOKEN

with .env next to the compose file:

GH_TOKEN=...

docker compose build mounts the secret from that value (BuildKit type=env secret), so it never lands in the image nor in a dedicated secret file. Just verified: with GH_TOKEN absent from the host environment, the secret is populated from .env.

The same rule applies to build.args entries declared without = (e.g. args: [SOME_FLAG]): the value is taken from that same environment, .env included — though for a token you want the secret mount above, not a build arg.

In your setup, 1Password gating reads of .env means the auth prompt fires when the dev-containers plugin triggers docker compose build, which is exactly the flow you're after.