Read DOCKER_AGENT_ENV_-prefixed secret variables before the plain names
维护者通常 1 天内回复
评估
这个 Issue 还没有评估数据。
描述
Overview
Let docker-agent read DOCKER_AGENT_ENV_<NAME> in preference to <NAME> for every secret it resolves (e.g. DOCKER_AGENT_ENV_ANTHROPIC_API_KEY before ANTHROPIC_API_KEY).
Motivation
docker-agent resolves op:// 1Password references, which is a nice way to avoid plain-text keys. But the variable names are shared with other tools: exporting ANTHROPIC_API_KEY="op://…" in the shell breaks Claude Code, Codex and provider SDKs, which do not resolve op://. Today the workarounds are the docker-agent env file (~/.config/cagent/.env) or a per-model token_key, which must be repeated in every model of every config and does not apply to --model provider/model.
Use cases
export DOCKER_AGENT_ENV_ANTHROPIC_API_KEY="op://Personal/Anthropic/api-key"
export ANTHROPIC_API_KEY=sk-ant-... # or unset; used by other tools
docker agent run agent.yaml # uses the op:// reference
Also lets a user point docker-agent at a different key (separate billing/project) without touching other tools.
Proposed solution
A PrefixedProvider decorator in pkg/environment, wired through a single chain constructor as OnePassword(Prefixed(Multi(sources...))), so a prefixed value can itself be an op:// reference.
Decisions (revised after code review, see the comment below):
- Prefix
DOCKER_AGENT_ENV_.DOCKER_AGENT_is docker-agent's settings namespace; names already in it are never looked up as overrides. - Precedence:
DOCKER_AGENT_ENV_<NAME>wins across the whole chain,--env-from-fileincluded. - Empty values: an empty override is ignored and
<NAME>is used.
Doctor and follow-ups:
docker agent doctor(findSource) queries sources directly and would report the key as missing; teach it the prefix and show which name supplied the value.- The TUI transcriber reads
OPENAI_API_KEYwithos.Getenv(bypassing bothop://and the prefix); fixing it needs lazy resolution, so it is deferred to a separate PR.
Known limitation: in --sandbox, keys Docker Desktop proxies itself (OPENAI_API_KEY, ANTHROPIC_API_KEY, …) never go through our chain, so neither op:// nor the prefix applies to them there. Documented, not changed.
Alternatives
- Per-model
token_key: works, but verbose and not available for--modelshorthand. - Docker Agent env file: works, but a plain shell export of the same name still wins, which is the common setup for users of several AI tools.
Related issues
- #4701: docs fix for the credential helper scope and an
op://isolation tip. - #4703: credential helper for all secrets.
- #4708: implementation.
- 主要语言
- Go
- 星标
- 4.6k
- 派生
- 522
- 平均合并
- 10 小时 33 分钟
- 30 天内合并 PR
- 231
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
docker/docker-agent 的其他 Issue
-
Error when trying to run sandbox example?可能已有人在做 @dgageot 于 2 天前认领。 未关闭area/cli
难度 2/5 1-3 小时 新手友好度 62/100
docker/docker-agent#4672 · 1 条评论 · 1 个 reaction · 已指派 1 人 ·
维护者通常 1 天内回复
-
pkg/hooks tests fail with a misleading assertion when jq is not installed可能已有人在做 @dwin-gharibi 于 60 天前认领。 未关闭area/testing
难度 2/5 1-3 小时 新手友好度 86/100
docker/docker-agent#4052 ·
维护者通常 1 天内回复
-
`remove_directory` and `create_directory` hide work they already did when a later path fails可能已有人在做 @dwin-gharibi 于 78 天前认领。 未关闭area/tools
难度 2/5 1-3 小时 新手友好度 85/100
docker/docker-agent#3933 ·
维护者通常 1 天内回复
-
`edit_file` silently edits the first match when `oldText` occurs more than once可能已有人在做 @dwin-gharibi 于 78 天前认领。 未关闭area/tools
难度 2/5 1-3 小时 新手友好度 78/100
docker/docker-agent#3929 · 2 条评论 ·
维护者通常 1 天内回复
-
area/config area/mcp area/providers area/security kind/feat status/needs-design
难度 5/5 一周以上 新手友好度 35/100
docker/docker-agent#4703 ·
维护者通常 1 天内回复
查看 docker/docker-agent 的全部 Issue
相似的 Issue
-
status:needs-review type:bug
难度 2/5 1-3 小时 新手友好度 78/100
Gentleman-Programming/engram#2079 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 77/100
limitlessprojects/Go-Hybrid#1377 ·
维护者通常 1 天内回复
-
bug report
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 3 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
-
难度 2/5 1-3 小时 新手友好度 67/100
维护者通常 1 天内回复