Implement args syntax of build section in compose environment

[garagatyi]

Compose supports build arguments https://docs.docker.com/compose/compose-file/#/args .
This feature should not support evaluation of value of arg from environment of host.

Tasks:

• implement basic support of args
• add possibility to forbid some names of args or prefixes

[bmicklea]

@l0rd or @mmorhun do you think this is something you can help with? Alex is going on vacation and it would be great to get this added into our compose syntax.

[l0rd]

@bmicklea I can start working on that Wednesday next week. If it's not too late I would love to take that.

[bmicklea]

That's great @l0rd thank you!

[bmicklea]

This is critical to M6.

[l0rd]

I'm working on that. I will provide an update tomorrow.

[bmicklea]

Thanks very much Mario!

[l0rd]

@bmicklea I will provide a PR for the first task tomorrow, monday in the worst case.

The second task (add possibility to forbid some names of args or prefixes) is not clear to me. Why should we forbid some names/prefixes? Which ones are we going to forbid? Since @garagatyi is on vacation can someone else can answer my questions?

[bmicklea]

Thanks Mario, that's great news!

I am not sure what Alex what thinking with that one Mario - are there perhaps args or prefixes that could cause bad behaviors in the system?

@skabashnyuk @gazarenkov is there anyone else who might have an idea of what Alex was considering with his second subtask?

[l0rd]

@bmicklea @skabashnyuk @gazarenkov @garagatyi I've submitted PR #2749 to address the first task.

For the second task ("add possibility to forbid some names of args or prefixes") it's maybe related to some CHE environment variables that we don't want to be overwritten by users?

[bmicklea]

@l0rd we will split this into two issues. Your PR is fine to fix the first task and we will move the second task to its own issue.

[bmicklea]

Second part of this issue is being separately tracked with #2760.

[l0rd]

@bmicklea that makes sense

[garagatyi]

The idea of the limitation is that in case of usage of docker management tool such as Swarm args can have impacts on the system where image is built. I don't have any particular example of such vulnerability, it is just a suggestion that there are some.

[bmicklea]

Closeing - PR merged. Thanks l0rd!