Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Read DOCKER_AGENT_ENV_-prefixed secret variables before the plain names

Abierto
  • ¿Algo no está bien?
#4,702 1 comentario 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@aheritier ya está trabajando en esto.

Desde el 22/10/2026.

  • #4708 de @aheritier — abierto
  • #4709 de @aheritier — abierto

Evaluación

Este issue todavía no se ha evaluado.

Descripción

area/cli area/config area/security kind/feat
Overview

Let docker-agent read DOCKER_AGENT_ENV_<NAME> in preference to <NAME> for every secret it resolves (e.g. DOCKER_AGENT_ENV_ANTHROPIC_API_KEY before ANTHROPIC_API_KEY).

Motivation

docker-agent resolves op:// 1Password references, which is a nice way to avoid plain-text keys. But the variable names are shared with other tools: exporting ANTHROPIC_API_KEY="op://…" in the shell breaks Claude Code, Codex and provider SDKs, which do not resolve op://. Today the workarounds are the docker-agent env file (~/.config/cagent/.env) or a per-model token_key, which must be repeated in every model of every config and does not apply to --model provider/model.

Use cases
export DOCKER_AGENT_ENV_ANTHROPIC_API_KEY="op://Personal/Anthropic/api-key"
export ANTHROPIC_API_KEY=sk-ant-...   # or unset; used by other tools
docker agent run agent.yaml          # uses the op:// reference

Also lets a user point docker-agent at a different key (separate billing/project) without touching other tools.

Proposed solution

A PrefixedProvider decorator in pkg/environment, wired through a single chain constructor as OnePassword(Prefixed(Multi(sources...))), so a prefixed value can itself be an op:// reference.

Decisions (revised after code review, see the comment below):

  1. Prefix DOCKER_AGENT_ENV_. DOCKER_AGENT_ is docker-agent's settings namespace; names already in it are never looked up as overrides.
  2. Precedence: DOCKER_AGENT_ENV_<NAME> wins across the whole chain, --env-from-file included.
  3. Empty values: an empty override is ignored and <NAME> is used.

Doctor and follow-ups:

  • docker agent doctor (findSource) queries sources directly and would report the key as missing; teach it the prefix and show which name supplied the value.
  • The TUI transcriber reads OPENAI_API_KEY with os.Getenv (bypassing both op:// and the prefix); fixing it needs lazy resolution, so it is deferred to a separate PR.

Known limitation: in --sandbox, keys Docker Desktop proxies itself (OPENAI_API_KEY, ANTHROPIC_API_KEY, …) never go through our chain, so neither op:// nor the prefix applies to them there. Documented, not changed.

Alternatives
  • Per-model token_key: works, but verbose and not available for --model shorthand.
  • Docker Agent env file: works, but a plain shell export of the same name still wins, which is the common setup for users of several AI tools.
Related issues
  • #4701: docs fix for the credential helper scope and an op:// isolation tip.
  • #4703: credential helper for all secrets.
  • #4708: implementation.
Lenguaje dominante
Go
Estrellas
4.6k
Forks
522
Merge medio
10 h 33 min
PR fusionados (30 d)
231

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de docker/docker-agent

Todos los issues de docker/docker-agent

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.