How to allow user-specific environment variables in a container?

[Roemer]

I have the case that each of the developers has a different environment value, for example an api token that is bound to the developers account.
What is the proposal to do something like this? The values cannot be added to devcontainer.json as they should not be commited to git. I tried using separate optional .env files but that does not work as well because docker and compose do not support optional env files unfortunately.

[liiight]

If you need it at container runtime, you can create an .env file via initializeCommand. Then you can have docker compose set that env file for the service.
Consider something like this:

devcontainer.json

{
  "initializeCommand": "echo \"USERNAME=$USER\nUSER_UID=$(id -u $USER)\nGROUPNAME=$(id -gn $USER)\nGROUP_GID=$(id -g $USER)\nIS_AMD=$(test $(uname -m) = amd64 && echo true || echo false)\" > .devcontainer/.env",
  "dockerComposeFile": "../docker-compose.yml",
  "service": "main"
}

docker-compose:

services:
  main:
    image: my_image:latest
    env_file:
      - .devcontainer/.env

This would probably fail on the first run since the .env will be created in the same context as the docker-compose command, but after that it should work, I use a variation of this as well.

Note that this will work ONLY for container environment variable and not environment variables you need to have present at build time.

[evilhamsterman]

You can use the containerEnv|remoteEnv and localEnv with templating to set environment variables in the container.

{
  "containerEnv": {
    "INTERNAL_VAR": "${localEnv:YOUR_EXTERNAL_VAR}",
    "INTERNAL_VAR_DEFAULT": "${localEnv:YOUR_UNSET_VAR:default value}"
}

The difference between containerEnv and remoteEnv is the former bakes the variable into the container but the later sets the variable when the container starts so it's better for things that may change regularly

[Roemer]

I got a fairly simple solution for this problem:

• I have an initializeCommand which makes sure that the file .devcontainer/.env.run exists via touch .devcontainer/.env.run
• In the runArgs, I have --env-file, ${localWorkspaceFolder}/.devcontainer/.env.run
• .devcontainer/.env.run is in .gitignore

This allows the file to be empty but whoever needs environment variables added, can add them there.

As a bonus, I also added the possibility to define a .env.build file which is used during the build phase.
When using this, I switched building the container from the dockerfile to the initializeCommand (see microsoft/vscode-remote-release#3545 (comment) for details).

Then I can read the arguments from the file and add them to the docker build. Here is an example of a working build.sh file that is used in initializeCommand:

#!/bin/bash -x
# Make sure the required env files exist
touch ./.devcontainer/.env.build
touch ./.devcontainer/.env.run
# Read all lines from the file and add them as build arguments, ignore empty, starting with # or after #
ARGUMENTS_FROM_FILE=""
for i in `cat ./.devcontainer/.env.build | grep -vE "^(#.*|\s*)$" | sed 's/#.*//g'`; do
    ARGUMENTS_FROM_FILE+="--build-arg $i "
done
# Run the build
docker build --tag=my-project-dev --add-host=host.docker.internal:host-gateway $ARGUMENTS_FROM_FILE .devcontainer