From 667f55c2ce37fa9ff39cf3da961b80733bfeec1e Mon Sep 17 00:00:00 2001 From: Joe Doss Date: Mon, 30 Mar 2026 00:51:38 -0500 Subject: [PATCH 1/2] Fix shell driver DriverOpts cross-contamination in secret creation When creating a secret with driver=shell via the API, the file driver's default DriverOpts (including path) were applied because DriverOpts was empty. The shell driver rejects path as an unknown option, making it impossible to create shell-driver secrets via the REST API or podman-remote. Only apply default DriverOpts from config when the requested driver matches the configured default driver. Signed-off-by: Joe Doss --- pkg/domain/infra/abi/secrets.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/domain/infra/abi/secrets.go b/pkg/domain/infra/abi/secrets.go index 32dae29e53..25952927dd 100644 --- a/pkg/domain/infra/abi/secrets.go +++ b/pkg/domain/infra/abi/secrets.go @@ -33,7 +33,7 @@ func (ic *ContainerEngine) SecretCreate(_ context.Context, name string, reader i if options.Driver == "" { options.Driver = cfg.Secrets.Driver } - if len(options.DriverOpts) == 0 { + if len(options.DriverOpts) == 0 && options.Driver == cfg.Secrets.Driver { options.DriverOpts = cfg.Secrets.Opts } if options.DriverOpts == nil { From 8b905613b5a388fe4bd5e98f27a36cf620d454d1 Mon Sep 17 00:00:00 2001 From: Joe Doss Date: Mon, 30 Mar 2026 08:36:00 -0500 Subject: [PATCH 2/2] Add e2e test for shell driver DriverOpts cross-contamination fix Verify that creating a secret with driver=shell and no --driver-opts does not inherit the file driver's default path option. Before the fix, this produced "invalid shell driver option"; after, it correctly fails with "missing config value" for unconfigured shell commands. Signed-off-by: Joe Doss --- test/e2e/secret_test.go | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/test/e2e/secret_test.go b/test/e2e/secret_test.go index aa9a880a7d..a51f62fd07 100644 --- a/test/e2e/secret_test.go +++ b/test/e2e/secret_test.go @@ -504,6 +504,25 @@ var _ = Describe("Podman secret", func() { Expect(exists).Should(ExitWithError(1, "")) }) + It("podman secret create with non-default driver does not inherit default driver opts", func() { + secretFilePath := filepath.Join(podmanTest.TempDir, "secret") + err := os.WriteFile(secretFilePath, []byte("mysecret"), 0o755) + Expect(err).ToNot(HaveOccurred()) + + // Create a secret with driver=shell but no --driver-opts. + // Before the fix, the file driver's default "path" opt bled + // into the shell driver, causing "invalid shell driver option". + // After the fix, the shell driver correctly receives no + // foreign opts and fails only because its required commands + // (store, lookup, list, delete) are not configured. + session := podmanTest.Podman([]string{ + "secret", "create", "-d", "shell", + "shell-secret", secretFilePath, + }) + session.WaitWithDefaultTimeout() + Expect(session).Should(ExitWithError(125, "missing config value")) + }) + It("podman secret create from stdin", func() { secretData := "mysecretdata" secretName := "stdin-secret-" + stringid.GenerateRandomID()