Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Read DOCKER_AGENT_ENV_-prefixed secret variables before the plain names

Chiusa
  • Qualcosa non va?
#4,702 1 commento 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@aheritier ci sta già lavorando.

Dal 22/10/2026.

  • #4708 di @aheritier — integrata

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

area/cli area/config area/security kind/feat
Overview

Let docker-agent read DOCKER_AGENT_ENV_<NAME> in preference to <NAME> for every secret it resolves (e.g. DOCKER_AGENT_ENV_ANTHROPIC_API_KEY before ANTHROPIC_API_KEY).

Motivation

docker-agent resolves op:// 1Password references, which is a nice way to avoid plain-text keys. But the variable names are shared with other tools: exporting ANTHROPIC_API_KEY="op://…" in the shell breaks Claude Code, Codex and provider SDKs, which do not resolve op://. Today the workarounds are the docker-agent env file (~/.config/cagent/.env) or a per-model token_key, which must be repeated in every model of every config and does not apply to --model provider/model.

Use cases
export DOCKER_AGENT_ENV_ANTHROPIC_API_KEY="op://Personal/Anthropic/api-key"
export ANTHROPIC_API_KEY=sk-ant-...   # or unset; used by other tools
docker agent run agent.yaml          # uses the op:// reference

Also lets a user point docker-agent at a different key (separate billing/project) without touching other tools.

Proposed solution

A PrefixedProvider decorator in pkg/environment, wired through a single chain constructor as OnePassword(Prefixed(Multi(sources...))), so a prefixed value can itself be an op:// reference.

Decisions (revised after code review, see the comment below):

  1. Prefix DOCKER_AGENT_ENV_. DOCKER_AGENT_ is docker-agent's settings namespace; names already in it are never looked up as overrides.
  2. Precedence: DOCKER_AGENT_ENV_<NAME> wins across the whole chain, --env-from-file included.
  3. Empty values: an empty override is ignored and <NAME> is used.

Doctor and follow-ups:

  • docker agent doctor (findSource) queries sources directly and would report the key as missing; teach it the prefix and show which name supplied the value.
  • The TUI transcriber reads OPENAI_API_KEY with os.Getenv (bypassing both op:// and the prefix); fixing it needs lazy resolution, so it is deferred to a separate PR.

Known limitation: in --sandbox, keys Docker Desktop proxies itself (OPENAI_API_KEY, ANTHROPIC_API_KEY, …) never go through our chain, so neither op:// nor the prefix applies to them there. Documented, not changed.

Alternatives
  • Per-model token_key: works, but verbose and not available for --model shorthand.
  • Docker Agent env file: works, but a plain shell export of the same name still wins, which is the common setup for users of several AI tools.
Related issues
  • #4701: docs fix for the credential helper scope and an op:// isolation tip.
  • #4703: credential helper for all secrets.
  • #4708: implementation.
Lingua principale
Go
Stelle
4.6k
Fork
522
Merge medio
11h 42m
PR unite (30g)
208

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di docker/docker-agent

Tutte le issue di docker/docker-agent

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.