From 2d192ccb9dc88bce1e4d802c120c4805d5c2ccbb Mon Sep 17 00:00:00 2001
From: Nicolas De Loof <nicolas.deloof@gmail.com>
Date: Wed, 8 Oct 2025 12:20:34 +0200
Subject: [PATCH] bake only interpolates ${*}

Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
---
 pkg/compose/build_bake.go                       | 12 +++---------
 pkg/e2e/build_test.go                           | 11 ++++++++---
 .../fixtures/build-test/escaped/compose.yaml    | 17 +++++++++++++++++
 3 files changed, 28 insertions(+), 12 deletions(-)

diff --git a/pkg/compose/build_bake.go b/pkg/compose/build_bake.go
index 71735dcb06a..777e69942a6 100644
--- a/pkg/compose/build_bake.go
+++ b/pkg/compose/build_bake.go
@@ -184,12 +184,9 @@ func (s *composeService) doBuildBake(ctx context.Context, project *types.Project
 		build := *service.Build
 		labels := getImageBuildLabels(project, service)
 
-		args := types.Mapping{}
-		for k, v := range resolveAndMergeBuildArgs(s.dockerCli, project, service, options) {
-			if v == nil {
-				continue
-			}
-			args[k] = *v
+		args := resolveAndMergeBuildArgs(s.dockerCli, project, service, options).ToMapping()
+		for k, v := range args {
+			args[k] = strings.ReplaceAll(v, "${", "$${")
 		}
 
 		entitlements := build.Entitlements
@@ -280,9 +277,6 @@ func (s *composeService) doBuildBake(ctx context.Context, project *types.Project
 		return nil, err
 	}
 
-	// escape all occurrences of '$' as we interpolated everything that has to
-	b = bytes.ReplaceAll(b, []byte("$"), []byte("$$"))
-
 	if options.Print {
 		_, err = fmt.Fprintln(s.stdout(), string(b))
 		return nil, err
diff --git a/pkg/e2e/build_test.go b/pkg/e2e/build_test.go
index e0533261652..2acabe51dd6 100644
--- a/pkg/e2e/build_test.go
+++ b/pkg/e2e/build_test.go
@@ -648,8 +648,13 @@ func TestBuildTLS(t *testing.T) {
 
 func TestBuildEscaped(t *testing.T) {
 	c := NewParallelCLI(t)
-	// ensure local test run does not reuse previously build image
-	c.RunDockerOrExitError(t, "rmi", "build-test-tags")
-	res := c.RunDockerComposeCmd(t, "--project-directory", "./fixtures/build-test/escaped", "build", "--no-cache")
+
+	res := c.RunDockerComposeCmd(t, "--project-directory", "./fixtures/build-test/escaped", "build", "--no-cache", "foo")
 	res.Assert(t, icmd.Expected{Out: "foo is ${bar}"})
+
+	res = c.RunDockerComposeCmd(t, "--project-directory", "./fixtures/build-test/escaped", "build", "--no-cache", "echo")
+	res.Assert(t, icmd.Success)
+
+	res = c.RunDockerComposeCmd(t, "--project-directory", "./fixtures/build-test/escaped", "build", "--no-cache", "arg")
+	res.Assert(t, icmd.Success)
 }
diff --git a/pkg/e2e/fixtures/build-test/escaped/compose.yaml b/pkg/e2e/fixtures/build-test/escaped/compose.yaml
index 997af4e9209..2d0077b9e63 100644
--- a/pkg/e2e/fixtures/build-test/escaped/compose.yaml
+++ b/pkg/e2e/fixtures/build-test/escaped/compose.yaml
@@ -4,3 +4,20 @@ services:
       context: .
       args:
         foo: $${bar}
+
+  echo:
+    build:
+      dockerfile_inline: |
+        FROM bash
+        RUN <<'EOF'
+        echo $(seq 10)
+        EOF
+
+  arg:
+    build:
+      args:
+        BOOL: "true"
+      dockerfile_inline: |
+        FROM alpine:latest
+        ARG BOOL
+        RUN /bin/$${BOOL}