Description
The --secret and --config flags accept both a "basic" and "advanced" (csv / option=value) syntax.
Docker fails to detect the "advanced" syntax if there is no comma in the options passed, and as a result, attempts to use option=value as name for the secret.
Describe the results you received:
-
Create a config and a secret:
echo hello | docker config create myconfig -
echo hello | docker secret create mysecret -
-
Create a service that uses the config, using the advanced ("csv" / "option=value") syntax
docker service create --name hello1 --config source=myconfig nginx:alpine
config not found: source=myconfig
-
Create a service that uses the secret, using the advanced ("csv" / "option=value") syntax
docker service create --name hello2 --secret source=mysecret nginx:alpine
secret not found: source=mysecret
-
Create a service that uses the config, using the "basic" syntax (just referencing the name)
docker service create --name hello3 --config myconfig nginx:alpine
08oc61ewfwbkxmasstkgv5yzw
overall progress: 1 out of 1 tasks
1/1: running [==================================================>]
verify: Service converged
-
Create a service that uses the config, using the "basic" syntax (just referencing the name)
docker service create --name hello4 --secret mysecret nginx:alpine
k0fki16c5anjsylywuc75xxy1
overall progress: 1 out of 1 tasks
1/1: running [==================================================>]
verify: Service converged
Describe the results you expected:
Both --secret mysecret and --secret source=mysecret should work
Secret (and config) names are restricted to [a-zA-Z0-9-_.], so --secret source=blabla should not be ambiguous
echo blabla | docker secret create source=blabla -
Error response from daemon: rpc error: code = InvalidArgument desc = invalid name, only 64 [a-zA-Z0-9-_.] characters allowed, and the start and end character must be [a-zA-Z0-9]
Proposed fix
In the "single value" case, check if the value contains a =, and if that's the case, don't return early
Parsing for secrets:
|
// support a simple syntax of --secret foo |
|
if len(fields) == 1 { |
|
options.File.Name = fields[0] |
|
options.SecretName = fields[0] |
|
o.values = append(o.values, options) |
|
return nil |
|
} |
Parsing for configs:
|
// support a simple syntax of --config foo |
|
if len(fields) == 1 { |
|
options.File.Name = fields[0] |
|
options.ConfigName = fields[0] |
|
o.values = append(o.values, options) |
|
return nil |
|
} |
We should also check other flags that accept both "basic" and "advanced" syntax, to see if they have similar issues
Output of docker version:
Client: Docker Engine - Community
Version: 19.03.1
API version: 1.40
Go version: go1.12.5
Git commit: 74b1e89
Built: Thu Jul 25 21:18:17 2019
OS/Arch: darwin/amd64
Experimental: true
Server: Docker Engine - Community
Engine:
Version: 19.03.1
API version: 1.40 (minimum version 1.12)
Go version: go1.12.5
Git commit: 74b1e89
Built: Thu Jul 25 21:17:52 2019
OS/Arch: linux/amd64
Experimental: true
containerd:
Version: v1.2.6
GitCommit: 894b81a4b802e4eb2a91d1ce216b8817763c29fb
runc:
Version: 1.0.0-rc8
GitCommit: 425e105d5a03fabd737a126ad93d62a9eeede87f
docker-init:
Version: 0.18.0
GitCommit: fec3683
Description
The
--secretand--configflags accept both a "basic" and "advanced" (csv / option=value) syntax.Docker fails to detect the "advanced" syntax if there is no comma in the options passed, and as a result, attempts to use
option=valueas name for the secret.Describe the results you received:
Create a config and a secret:
Create a service that uses the config, using the advanced ("csv" / "option=value") syntax
Create a service that uses the secret, using the advanced ("csv" / "option=value") syntax
Create a service that uses the config, using the "basic" syntax (just referencing the name)
docker service create --name hello3 --config myconfig nginx:alpine 08oc61ewfwbkxmasstkgv5yzw overall progress: 1 out of 1 tasks 1/1: running [==================================================>] verify: Service convergedCreate a service that uses the config, using the "basic" syntax (just referencing the name)
docker service create --name hello4 --secret mysecret nginx:alpine k0fki16c5anjsylywuc75xxy1 overall progress: 1 out of 1 tasks 1/1: running [==================================================>] verify: Service convergedDescribe the results you expected:
Both
--secret mysecretand--secret source=mysecretshould workSecret (and config) names are restricted to
[a-zA-Z0-9-_.], so--secret source=blablashould not be ambiguousProposed fix
In the "single value" case, check if the value contains a
=, and if that's the case, don't return earlyParsing for secrets:
cli/opts/secret.go
Lines 34 to 40 in ae16187
Parsing for configs:
cli/opts/config.go
Lines 34 to 40 in ae16187
We should also check other flags that accept both "basic" and "advanced" syntax, to see if they have similar issues
Output of
docker version: