container/env¶

Environment variables for the generic containerStart and containerExec actions.

A direct object mapping environment variable names to string values, e.g. {"FOO": "bar", "BAZ": "qux"}.

On containerStart these become the created container's environment; on containerExec they are added to the environment of the one command being run inside an already-running container. In both cases the values reach the container through a --env-file written to a temporary file on the plugin host -- they are never placed on the container engine's command line, so they do not appear in a ps listing of the plugin process or its container-engine invocation.

Because an env-file is line-based, a value (or a key) containing a newline or a carriage return cannot be represented in it and is rejected with a validation error rather than silently truncated or split into extra environment entries.

For the same reason a key must not begin with #, and must not have leading or trailing whitespace: both docker's and podman's env-file parsers read a # line as a comment and trim whitespace around a key, so such a variable would simply never arrive in the container. That is worse than a rejection, because the caller has no way to tell the difference between "set to something the container ignored" and "never set at all", so these are rejected with a validation error too.

The env-file boundary defends against a host ps listing, not against the action record. DRP records the action invocation, and the redaction it applies (models.Action.Clean()) matches only top-level parameter names that look secret -- ones containing password, key, secret, token or credential -- and does not recurse into a parameter's value. container/env is one parameter whose value is an object, so the name does not match and the values inside it are not redacted: they are visible in the recorded action to anyone who can read it.

A caller passing a credential here should assume it is readable there. Prefer a short-lived credential, or one the plugin fetches itself, over a long-lived secret handed in through this parameter.

The default is an empty object.

Objects that Reference container/env¶

Not used in current content packs

Objects used by container/env¶

Not used in current content packs