Quadlet: consider supporting environment / .env syntax interpolation

[orchard0]

Issue Description

Environment interpolation does not work in .env files set using EnvironmentFile option nor in the Environment option in .container files.

Steps to reproduce the issue

example.container:

[Container]
...
Environment=POSTGRES_USER=example 
Environment=AUTHENTIK_POSTGRESQL__USER=${POSTGRES_USER}
...

Nor does it work in an attached .env file set using the EnvironmentFile option:

POSTGRES_PASSWORD=mypassword
AUTHENTIK_POSTGRESQL__PASSWORD=${POSTGRES_PASSWORD}

Describe the results you received

Interpolation does not occur.

AUTHENTIK_POSTGRESQL__PASSWORD and AUTHENTIK_POSTGRESQL__USER are not set.

Describe the results you expected

AUTHENTIK_POSTGRESQL__USER to be set to example
AUTHENTIK_POSTGRESQL__PASSWORD to be set to mypassword

podman info output

Podman version 5.4.0

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

No

Additional environment details

No response

Additional information

No response

[ygalblum]

Not sure that this is a Quadlet issue. I've tried the following:

$ podman run --rm -e POSTGRES_USER=example -e AUTHENTIK_POSTGRESQL__USER=${POSTGRES_USER} fedora:42 /bin/bash -c "env"
HOSTNAME=d9168b7254b8
PWD=/
container=oci
HOME=/root
SHLVL=0
POSTGRES_USER=example
PATH=/usr/local/bin:/usr/bin
AUTHENTIK_POSTGRESQL__USER=
_=/usr/bin/env

You can see that AUTHENTIK_POSTGRESQL__USER is set to nothing.

[orchard0]

I've been migrating from a systemd compose.yaml setup and expected this would work. Is interpolation out of the question then?

[ygalblum]

systemd compose.yaml setup

Not sure what this means? A systemd unit that runs docker compose?

Is interpolation out of the question then?

Can you please provide an example of what works for you?

From your question, it seems that you're mixing different environment and expecting the same variables to be set. Using -e POSTGRES_USER=example in podman run sets the environment variable inside the container. So, ${POSTGRES_USER} has no meaning outside of it (where the podman run call is processed)

[orchard0]

Not sure what this means? A systemd unit that runs docker compose?

I've been running compose files on systemd using podman-compose systemd -a register and systemctl --user enable --now podman-compose@myproject. These compose.yaml files have an associated .env file containing the environment variables. These variables include interpolations like:

POSTGRES_USER=example 
AUTHENTIK_POSTGRESQL__USER=${POSTGRES_USER}

When the compose is ran using systemd the variable AUTHENTIK_POSTGRESQL__USER will take the value of example and the compose will run without errors.

As I've migrated these compose files to quadlet .container files and associated them with .env files the interpolation no longer works. Now there is an error during runtime because not all the environment variables got set to the value they should have i.e. AUTHENTIK_POSTGRESQL__USER has the value of not example.

Another simplified example:

DOMAIN=example.com
SECURE=secure.${DOMAIN}
AUTH=auth.${DOMAIN}
SHOP=shop.${DOMAIN}

I'd like SHOP to be set to shop.example.com as it does correctly in compose files ran on systemd and not give an error because SHOP was set to shop..

I've given simple examples above but some projects can contain complex interpolations. Manually changing each variable to be 'hard' coded would not be practical as these projects can be used in different contexts by simply exporting a different variable.

I hope that's clearer.

Thank you.

[orchard0]

The following is a simple example to demonstrate the situation.

compose.yaml:

services:
    fedora:
        image: fedora:42
        environment:
            - POSTGRES_USER=example
            - AUTHENTIK_POSTGRESQL__USER=${POSTGRES_USER}
        command: /bin/bash -c "env"

Run using podman-compose systemd -a register and systemctl --user enable --now 'podman-compose@myproject'. journalctl --user -xeu 'podman-compose@myproject' will show:

...
Sep 11 09:48:41 fedora myproject_fedora_1[40221]: POSTGRES_USER=example
Sep 11 09:48:41 fedora myproject_fedora_1[40221]: AUTHENTIK_POSTGRESQL__USER=example
...

That's working as expected. Whereas a quadlet example.container file:

[Container]
Image=fedora:42
Environment=POSTGRES_USER=example 
Environment=AUTHENTIK_POSTGRESQL__USER=${POSTGRES_USER}
Exec=/bin/bash -c env

Run using systemctl --user start example.service. journalctl --user -xeu example.service will show:

...
Sep 11 09:55:03 fedora systemd-example[41204]: POSTGRES_USER=example
Sep 11 09:55:03 fedora systemd-example[41204]: AUTHENTIK_POSTGRESQL__USER=
...

I hope that's clearer.

[ygalblum]

@orchard0 thanks for clarifying. The environment variables interpolation you are describing is done by compose before calling podman.
BTW it is the same for docker:

$ docker run --rm -e POSTGRES_USER=example -e AUTHENTIK_POSTGRESQL__USER=${POSTGRES_USER} fedora:42 /bin/bash -c "env"
HOSTNAME=e26afc0695a9
DISTTAG=f42container
PWD=/
FBR=f42
HOME=/root
FGC=f42
SHLVL=0
POSTGRES_USER=example
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
AUTHENTIK_POSTGRESQL__USER=
_=/usr/sbin/env

Have you looked into using a K8S yaml and a .kube Quadlet?

[Luap99]

Variable interpolation on the cli doesn't really make sense since the shell does it already.

For quadlet it just maps to the cli options and systemd does interpolation actually but only for service envs but also not withing several service envs I think.
Set the base vars for the systemd service section and then you could refer then in the container section most likely as they are just passed as argument on exec start, see #25053 (comment) for example.

Note that I would generally recommend against doing this though since --env cli arg with the "secret" envs would be visable on the cli when the command is run so it will be visible to all the process on the system which can be a security risk.
Using the EnvironmentFile would be better. Note the EnvironmentFile is quite simple and as you noted also doesn't do interpolation, doing so would be a breaking chnage as the file format is kinda locked. Any changes to the parser would likely cause major backwards compatibility issues.

So in general I don't think there is a way to do this with podman.