Bake segfault when setting variable defaulting to null from env

[skycaptain]

When setting a variable which defaults to null, I'm getting the following segfault.

docker-bake.hcl:

variable "FOO" { default = null }
target "default" { }

Error:

$ FOO="bar" docker buildx bake --print
[+] Building 0.0s (0/0)                                                                                                                                                                                                                           
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x845567]

goroutine 1 [running]:
github.com/docker/buildx/bake/hclparser.(*parser).resolveValue(0xc000531720, {0xc000908980, 0x3})
        github.com/docker/buildx/bake/hclparser/hclparser.go:244 +0xe27
github.com/docker/buildx/bake/hclparser.Parse({0x221aec8, 0xc000895698}, {0x1ff3f90?, 0xc000759d70?, 0x1ff0a50?}, {0x1d408e0?, 0xc000759da0})
        github.com/docker/buildx/bake/hclparser/hclparser.go:358 +0xbcd
github.com/docker/buildx/bake.ParseFiles({0xc0004e05a0, 0x1, 0x19?}, 0x18?)
        github.com/docker/buildx/bake/bake.go:238 +0xa45
github.com/docker/buildx/bake.ReadTargets({0x13?, 0x0?}, {0xc0004e05a0?, 0xc000056004?, 0x59?}, {0xc000837a20, 0x1, 0xc00079f801?}, {0x0, 0x0, ...}, ...)
        github.com/docker/buildx/bake/bake.go:88 +0x52
github.com/docker/buildx/commands.runBake({0x222a098, 0xc00017a2a0}, {0xc0003c2520, 0x0, 0x1}, {{0x3145700, 0x0, 0x0}, {0x0, 0x0, ...}, ...})
        github.com/docker/buildx/commands/bake.go:106 +0xb2c
github.com/docker/buildx/commands.bakeCmd.func1(0xc000733900?, {0xc0003c2520, 0x0, 0x1})
        github.com/docker/buildx/commands/bake.go:182 +0x205
github.com/spf13/cobra.(*Command).execute(0xc000733900, {0xc000409400, 0x1, 0x1})
        github.com/spf13/cobra@v1.5.0/command.go:872 +0x694
github.com/spf13/cobra.(*Command).ExecuteC(0xc000366500)
        github.com/spf13/cobra@v1.5.0/command.go:990 +0x3bd
github.com/spf13/cobra.(*Command).Execute(...)
        github.com/spf13/cobra@v1.5.0/command.go:918
github.com/docker/cli/cli-plugins/plugin.RunPlugin(0x1bf2840?, 0xc000733400, {{0x1ed207c, 0x5}, {0x1edbec5, 0xb}, {0x21f811c, 0x6}, {0x0, 0x0}, ...})
        github.com/docker/cli@v20.10.17+incompatible/cli-plugins/plugin/plugin.go:51 +0x130
main.runPlugin(0x1f12b08?)
        github.com/docker/buildx/cmd/buildx/main.go:45 +0x105
main.main()
        github.com/docker/buildx/cmd/buildx/main.go:62 +0xf9

docker info:

Client:
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.9.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.11.2
    Path:     /usr/libexec/docker/cli-plugins/docker-compose
  scan: Docker Scan (Docker Inc.)
    Version:  v0.17.0
    Path:     /usr/libexec/docker/cli-plugins/docker-scan

My usecase: I need to pass an ARG to my Dockerfile, which my be undefined, an empty string or a string. With plain Docker this is supported by just leaving the ARG empty, e.g. in my Dockerfile ARG FOO. If FOO is not defined via --build-args, it is not defined as environment variable either. To support a similar behaviour with buildx, this is the docker-bake.hcl I'm came up so far:

function "objectcompact" {
  // Takes an object and returns a new object with elements removed whose
  // value equals null
  params = [obj]
  result = {for k, v in obj : k => v if v != null}
}

variable "FOO" { default = null }

target "default" {
    args = objectcompact({
      FOO = FOO
    })
}

Dockerfile:

FROM debian
ARG FOO
RUN export -p

[JacobHayes]

This also happens when setting a list variable from an env var (for example, when trying to inject some custom tags):

variable "EXTRA_TAGS" { default = [] }
target "default" { }

$ docker buildx bake --print                                                                                          0.34s
[+] Building 0.0s (0/0)
{
  "target": {
    "default": {
      "context": ".",
      "dockerfile": "Dockerfile"
    }
  }
}
$ FOO="[]" docker buildx bake --print                                                                                 0.15s
[+] Building 0.0s (0/0)
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x1046d6f9c]

goroutine 1 [running]:
github.com/docker/buildx/bake/hclparser.(*parser).resolveValue(0x14000520000, {0x140005861c0, 0x3})
        /src/bake/hclparser/hclparser.go:244 +0xdbc
github.com/docker/buildx/bake/hclparser.Parse({0x105f93560, 0x14000191908}, {0x105f70dc0?, 0x14000588270?, 0x105f6d8a0?}, {0x105dde280?, 0x140005882a0})
        /src/bake/hclparser/hclparser.go:358 +0x998
github.com/docker/buildx/bake.ParseFiles({0x1400048bc20, 0x1, 0xffffffffffffffff?}, 0xffffffffffffffff?)
        /src/bake/bake.go:238 +0x7a8
github.com/docker/buildx/bake.ReadTargets({0x105c91d20?, 0x14000588270?}, {0x1400048bc20?, 0x13?, 0x0?}, {0x1400081f9f8, 0x1, 0x38?}, {0x0, 0x0, ...}, ...)
        /src/bake/bake.go:88 +0x50
github.com/docker/buildx/commands.runBake({0x105f9ddd8, 0x140001f82a0}, {0x140000a03c0, 0x0, 0x1}, {{0x106e5ba30, 0x0, 0x0}, {0x0, 0x0, ...}, ...})
        /src/commands/bake.go:106 +0x83c
github.com/docker/buildx/commands.bakeCmd.func1(0x14000425900?, {0x140000a03c0, 0x0, 0x1})
        /src/commands/bake.go:182 +0x1a4
github.com/spf13/cobra.(*Command).execute(0x14000425900, {0x140001f58e0, 0x1, 0x1})
        /src/vendor/github.com/spf13/cobra/command.go:872 +0x4d0
github.com/spf13/cobra.(*Command).ExecuteC(0x140001cd180)
        /src/vendor/github.com/spf13/cobra/command.go:990 +0x354
github.com/spf13/cobra.(*Command).Execute(...)
        /src/vendor/github.com/spf13/cobra/command.go:918
github.com/docker/cli/cli-plugins/plugin.RunPlugin(0x10575cfc6?, 0x14000425400, {{0x10575b2a1, 0x5}, {0x105764f25, 0xb}, {0x105a71ac8, 0x6}, {0x0, 0x0}, ...})
        /src/vendor/github.com/docker/cli/cli-plugins/plugin/plugin.go:51 +0x154
main.runPlugin(0x10579b304?)
        /src/cmd/buildx/main.go:45 +0xcc
main.main()
        /src/cmd/buildx/main.go:62 +0xdc

---

Client:
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc., v0.9.1)
  compose: Docker Compose (Docker Inc., v2.12.0)
  dev: Docker Dev Environments (Docker Inc., v0.0.3)
  extension: Manages Docker extensions (Docker Inc., v0.2.13)
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc., 0.6.0)
  scan: Docker Scan (Docker Inc., v0.21.0)

[tonistiigi]

I believe error for the case where nil value is interpolated into another value is correct, but maybe we can do something for the case where the value is used directly in a build-arg.

[JacobHayes]

I think fixing it for other bake file references (ie: not just build-args) would be useful. Eg: a more complete example for my comment above is:

variable "EXTRA_TAGS" { default = [] }

target "image" {
  tags       = concat(["my.registry/some/image"], EXTRA_TAGS)
}

• docker buildx bake --print image -> shows no error (and just the 1 hard coded tag)
• EXTRA_TAGS='["my.registry/some/image:abc"]' docker buildx bake --print image errors as above

I expected the list to be parsed and injected like simple variables the way terraform handles complex ones.

My guess was that this was an error in the environment variable parsing for "complex" types (eg: null, lists, etc), but I'm happy to open a separate issue if you think they're different!

[tonistiigi]

@JacobHayes Yeah, that is a different case. Variables atm are expected to be strings. For something like you are suggesting we need blocks like #1346 (comment) that define the type as well.

[tnaroska]

just ran into similar SIGSEGV issue trying to override a variable from env that is defaulted as [] in the bake file.
I put some extra plumbing to normalize the value depending on whether the input is a list or comma separated string.
That works in general (i.e. I can set the default in bake file to a list or a string and it does the right coercion to list). Only trying to override the vat from the env fails with the SIGSEGV.

Now, whether this variable override with differing type should be allowed in general could be argued. At least I would expect a meaningful error message from buildx if it is unsupported rather than SIGSEGV.

docker buildx version
github.com/docker/buildx v0.9.1 ed00243a0ce2a0aee75311b06e32d33b44729689

variable PLATFORMS {
    default = []
}

function normalize_list {
    params = [listOrString]
    result = [for s in try(split(",", listOrString), listOrString):
        trimspace(s)
    ]
}

target default {
    ...
    platforms = normalize_list(PLATFORMS)
}

$ PLATFORMS=something docker buildx bake -f b.hcl  --print
[+] Building 0.0s (0/0)                                                                                                                                        
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x142f407]

goroutine 1 [running]:
github.com/docker/buildx/bake/hclparser.(*parser).resolveValue(0xc0004a5680, {0xc000718870, 0x9})
	/src/bake/hclparser/hclparser.go:244 +0xe27
github.com/docker/buildx/bake/hclparser.Parse({0x2de3cd8, 0xc0005bc0f0}, {0x2bcaa08?, 0xc0007099b0?, 0x2bc74d8?}, {0x2919d40?, 0xc0007099e0})
	/src/bake/hclparser/hclparser.go:358 +0xb9a
github.com/docker/buildx/bake.ParseFiles({0xc000709980, 0x1, 0xc000bc9460?}, 0x0?)
	/src/bake/bake.go:238 +0xa45
github.com/docker/buildx/bake.ReadTargets({0x13?, 0x0?}, {0xc000709980?, 0xc00005a064?, 0x2b?}, {0xc000537a20, 0x1, 0xc00089f801?}, {0x0, 0x0, ...}, ...)
	/src/bake/bake.go:88 +0x52
github.com/docker/buildx/commands.runBake({0x2deebc8, 0xc0004ec2a0}, {0xc000319bc0, 0x0, 0x3}, {{0xc0004ff7b0, 0x1, 0x1}, {0x0, 0x0, ...}, ...})
	/src/commands/bake.go:106 +0xb12
github.com/docker/buildx/commands.bakeCmd.func1(0xc000420a00?, {0xc000319bc0, 0x0, 0x3})
	/src/commands/bake.go:182 +0x1e8
github.com/spf13/cobra.(*Command).execute(0xc000420a00, {0xc000594610, 0x3, 0x3})
	/src/vendor/github.com/spf13/cobra/command.go:872 +0x694
github.com/spf13/cobra.(*Command).ExecuteC(0xc0003cb400)
	/src/vendor/github.com/spf13/cobra/command.go:990 +0x3b4
github.com/spf13/cobra.(*Command).Execute(...)
	/src/vendor/github.com/spf13/cobra/command.go:918
github.com/docker/cli/cli-plugins/plugin.RunPlugin(0x27cca60?, 0xc000420500, {{0x2aaa2fc, 0x5}, {0x2ab3e8c, 0xb}, {0x2dc1518, 0x6}, {0x0, 0x0}, ...})
	/src/vendor/github.com/docker/cli/cli-plugins/plugin/plugin.go:51 +0x130
main.runPlugin(0x2aea212?)
	/src/cmd/buildx/main.go:45 +0x105
main.main()
	/src/cmd/buildx/main.go:62 +0xf9