Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

NewStages(): "only allow header args" (dc7bc4f) also drops ARGs declared between stages, breaking a documented-valid Dockerfile pattern

Aperta
  • Qualcosa non va?
#323 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
68/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
docker, go
Ambito
build-system

Direzione di ricerca

Inizia leggendo NewStages() ed extractHeadingArgsFromNode, quindi riproduci l’esempio di Dockerfile con un ARG tra gli stage e confrontalo con lo stesso ARG prima del primo FROM. Traccia la gestione esistente degli stage e degli argomenti di heading; il lavoro è completato quando gli ARG locali allo stage rimangono isolati, mentre un ARG posizionato tra gli stage risolve il FROM successivo, e il comportamento documentato è coperto dai test.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Description

Commit dc7bc4f ("NewStages(): only allow header args", first released in v1.2.12) narrowed the set of ARGs considered "globally allowed" for resolving a stage's FROM from every ARG declared anywhere in the file down to only ARGs appearing before the very first FROM (via extractHeadingArgsFromNode, which permanently stops collecting once it sees the first FROM).

Besides the stated goal ("the full set of ARGs declared in every stage" was too permissive), it seems to have a side effect: an ARG declared between two stages, after an earlier stage's body, but before a later stage's FROM, is no longer available to resolve that later FROM. That placement is not the same as a stage-local ARG; it's the documented Docker/BuildKit pattern for parameterizing a later stage's base image without hoisting the ARG to the very top of the file:

[An ARG] declared before a FROM ... can be used in any FROM instruction in the build.
(Docker docs, "Understand how ARG and FROM interact")

Docker's wording says "before a FROM," not "before the first FROM", i.e. it documents exactly the pattern this commit stopped supporting.

Reproduction

FROM scratch AS config
COPY somefile /build/

ARG UPSTREAM_IMAGE
FROM ${UPSTREAM_IMAGE} AS base

RUN echo "base stage ran"

Building this with buildah bud --build-arg UPSTREAM_IMAGE=busybox ... (buildah ≥1.37, i.e. imagebuilder ≥1.2.12) fails: ${UPSTREAM_IMAGE} in the second FROM resolves to empty, and the caller (buildah) reports "no FROM statement found" because the resulting FROM line is blank. Moving the identical ARG UPSTREAM_IMAGE line above the first FROM fixes it with no other change. Ruled out as a factor: default values on the ARG, --build-arg presence, whether the earlier stage's output is consumed downstream, buildah's --skip-unused-stages, rootless vs rootful, storage driver. Full bisection and analysis (across buildah v1.29–v1.43) in the companion issue: containers/buildah#7016.

Ask

Could NewStages()/extractHeadingArgsFromNode be adjusted to keep collecting ARG nodes that appear between stages (i.e., outside of any stage's own body, at the top level of the file) rather than stopping for good at the first FROM? That would preserve the original commit's goal, stage-local ARGs (declared after a FROM, inside a stage) still wouldn't leak to later stages, while restoring the documented "ARG before the FROM that uses it" pattern.

If the current, stricter behavior is intentional, it'd be worth a changelog/release-notes callout, since right now it fails silently with a message that gives no hint the cause is ARG placement.

Environment

Observed via buildah (which vendors this library): v1.37.0 through v1.45.0 all reproduce; v1.36.0 (imagebuilder v1.2.9) does not.

Lingua principale
Go
Stelle
131
Fork
78
Merge medio
7g 41m
PR unite (30g)
1

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di openshift/imagebuilder

Tutte le issue di openshift/imagebuilder

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.