Skip to content

honor containers.conf http_proxy and env settings during build - #6996

Open
unlimitedsola wants to merge 1 commit into
podman-container-tools:mainfrom
sola-contrib:honor-containers-conf
Open

honor containers.conf http_proxy and env settings during build#6996
unlimitedsola wants to merge 1 commit into
podman-container-tools:mainfrom
sola-contrib:honor-containers-conf

Conversation

@unlimitedsola

@unlimitedsola unlimitedsola commented Jul 26, 2026

Copy link
Copy Markdown

What type of PR is this?

/kind bug

What this PR does / why we need it

This PR resolves an issue where podman build ignored containers.conf settings (http_proxy = false and [containers] env). Please also see the linked issue for more context.

  1. Binds the --http-proxy CLI flag default in pkg/cli/common.go to Containers.HTTPProxy from containers.conf instead of hardcoding true. This makes build proxy flag defaults consistent with podman run, allowing http_proxy = false in containers.conf to disable host environment proxy passthrough by default.
  2. Updates configureEnvironment() in run_common.go to inject environment variables defined under [containers] env in containers.conf into the transient container process spec (g.AddProcessEnv) during RUN steps. This fixes the regression from pre-6.0.x where containers.conf environment settings applied to build execution commands (e.g. package management and network requests).

How to verify it

  1. Configure containers.conf:

    [containers]
    http_proxy = false
    env = [
      "http_proxy=http://host.containers.internal:1080",
    ]
  2. Export host shell environment variables:

    export http_proxy=http://127.0.0.1:1080
  3. Run build:

    podman build --no-cache -f - . << 'EOF'
    FROM alpine
    RUN env | grep -i proxy
    EOF
  4. Verify output contains http_proxy=http://host.containers.internal:1080 instead of http://127.0.0.1:1080.

Which issue(s) this PR fixes

podman-container-tools/podman#29299

Special notes for your reviewer

g.AddProcessEnv in configureEnvironment() sets the process spec environment (g.Config.Process.Env) for transient container execution during RUN steps. It does not touch builder.OCIv1.Config.Env, ensuring that environment variables configured in containers.conf apply to build execution without polluting committed image layers.

Does this PR introduce a user-facing change?

Not sure if a release note is needed for regressions, but this does contain user-facing change:

Honor `containers.conf` `http_proxy` and `env` settings during image builds, aligning the behavior with `podman run` and fixed regression introduced in 6.0.x.

Comment thread run_common.go Outdated
}
}

if conf, err := config.Default(); err == nil {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would suggest against silently ignoring the error, similarly to other calls of config.Default in the file.

if err != nil {
	return nil, fmt.Errorf("failed to get container config: %w", err)
}

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the feedback! I changed the function signature so that the error can now bubble up instead of silently ignored.

Comment thread run_common.go

@nalind nalind left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but I expect you'll need to run make fmt to fix the linter formatter warning.

@TomSweeneyRedHat

Copy link
Copy Markdown
Contributor

LGTM
once the gofmt issue on line 87 in the test is made happy

@nalind

nalind commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Please squash your commits before merging. Thanks!

@unlimitedsola
unlimitedsola force-pushed the honor-containers-conf branch from 6efe36d to fb9edc4 Compare July 28, 2026 21:34
Default the `--http-proxy` CLI flag to `Containers.HTTPProxy` from
`containers.conf` instead of hardcoding `true`. This ensures the
behavior is consistent with `podman run`, allowing `http_proxy = false`
in `containers.conf` to disable host proxy passthrough by default.

Additionally, update `configureEnvironment()` to inject proxy environment
variables defined under `[containers] env` in `containers.conf` into the
transient container process environment during `RUN` steps.
This restores the pre-6.0.x behavior where `containers.conf` environment
settings applied to build execution steps, while ensuring runtime proxy
settings do not leak `ENV` directives into committed image metadata.

Signed-off-by: Sola <dev@sola.love>
@unlimitedsola
unlimitedsola force-pushed the honor-containers-conf branch from fb9edc4 to 0b2dad6 Compare July 28, 2026 21:35
@packit-as-a-service

Copy link
Copy Markdown

Ephemeral COPR build failed. @containers/packit-build please check.

@unlimitedsola

Copy link
Copy Markdown
Author

Ephemeral COPR build failed. @containers/packit-build please check.

I've squashed and rebased my commits. I think this was caused by me force-pushed twice too quickly?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants