ENVBUILDER_GIT_SSH_PRIVATE_KEY_BASE64 not exist in .env output

[Ricky-Hao]

1. Set ENVBUILDER_GIT_SSH_PRIVATE_KEY_BASE64 in locals.envbuilder_env.
2. Pass locals.envbuilder_env to envbuilder_cached_image
3. Pass envbuilder_cached_image.env to docker_container.env
4. The ENVBUILDER_GIT_SSH_PRIVATE_KEY_BASE64 env does not exist in container's environment.

locals {
  container_name             = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}"
  devcontainer_builder_image = data.coder_parameter.devcontainer_builder.value
  git_author_name            = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
  git_author_email           = data.coder_workspace_owner.me.email
  repo_url                   = data.coder_parameter.repo.value == "custom" ? data.coder_parameter.custom_repo_url.value : data.coder_parameter.repo.value
  # The envbuilder provider requires a key-value map of environment variables.
  envbuilder_env = {
    # ENVBUILDER_GIT_URL and ENVBUILDER_CACHE_REPO will be overridden by the provider
    # if the cache repo is enabled.
    "ENVBUILDER_GIT_URL" : local.repo_url,
    "ENVBUILDER_CACHE_REPO" : var.cache_repo,
    "CODER_AGENT_TOKEN" : coder_agent.main.token,
    # Use the docker gateway if the access URL is 127.0.0.1
    "CODER_AGENT_URL" : replace(data.coder_workspace.me.access_url, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal"),
    # Use the docker gateway if the access URL is 127.0.0.1
    "ENVBUILDER_INIT_SCRIPT" : replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal"),
    "ENVBUILDER_FALLBACK_IMAGE" : data.coder_parameter.fallback_image.value,
    "ENVBUILDER_DOCKER_CONFIG_BASE64" : try(data.local_sensitive_file.cache_repo_dockerconfigjson[0].content_base64, ""),
    "ENVBUILDER_PUSH_IMAGE" : var.cache_repo == "" ? "" : "true",
    "ENVBUILDER_GIT_SSH_PRIVATE_KEY_BASE64": base64encode(data.coder_workspace_owner.me.ssh_private_key),
    "ENVBUILDER_INSECURE" : "${var.insecure_cache_repo}",
  }
  # Convert the above map to the format expected by the docker provider.
  docker_env = [
    for k, v in local.envbuilder_env : "${k}=${v}"
  ]
}

resource "envbuilder_cached_image" "cached" {
  count         = var.cache_repo == "" ? 0 : data.coder_workspace.me.start_count
  builder_image = local.devcontainer_builder_image
  git_url       = local.repo_url
  cache_repo    = var.cache_repo
  extra_env     = local.envbuilder_env
  insecure      = var.insecure_cache_repo
  cache_ttl_days  = 90
}

resource "docker_container" "workspace" {
  count = data.coder_workspace.me.start_count
  image = var.cache_repo == "" ? local.devcontainer_builder_image : envbuilder_cached_image.cached.0.image
  # Uses lower() to avoid Docker restriction on container names.
  name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}"
  # Hostname makes the shell more user friendly: coder@my-workspace:~$
  hostname = data.coder_workspace.me.name
  # Use the environment specified by the envbuilder provider, if available.
  env = var.cache_repo == "" ? local.docker_env : envbuilder_cached_image.cached.0.env
  ...

[alecsg77]

I hit the same issue and after digging into the provider source I found the root cause.

Root cause

The provider's computeEnvFromOptions() builds env_map by iterating opts.CLI() — the list of CLI options known to the embedded envbuilder library version. ENVBUILDER_GIT_SSH_PRIVATE_KEY_BASE64 was introduced in envbuilder after v1.0.2, but the current provider release (v1.0.0) embeds envbuilder v1.0.2, which only has GIT_SSH_PRIVATE_KEY_PATH.

When extra_env is processed via overrideOptionsFromExtraEnv, unknown keys are silently discarded:

opt, found := optsMap[key]
if !found {
    // ignore unknown keys
    continue
}

So ENVBUILDER_GIT_SSH_PRIVATE_KEY_BASE64 is accepted in extra_env without error, but never makes it into env_map. The value simply disappears.

Meanwhile, the running container image (ghcr.io/coder/envbuilder:latest) is a newer build that does support ENVBUILDER_GIT_SSH_PRIVATE_KEY_BASE64 — so the option would work fine if the env var were actually passed to it.

Workaround

Until the provider is updated to embed a newer envbuilder library, inject the SSH key directly into the deployment using merge() to bypass env_map:

dynamic "env" {
  for_each = nonsensitive(merge(
    var.cache_repo == "" ? local.envbuilder_env : envbuilder_cached_image.cached.0.env_map,
    try(data.coder_workspace_owner.me.ssh_private_key, "") != "" ? {
      "ENVBUILDER_GIT_SSH_PRIVATE_KEY_BASE64" = base64encode(data.coder_workspace_owner.me.ssh_private_key)
    } : {}
  ))
  content {
    name  = env.key
    value = env.value
  }
}

Note for Docker templates: envbuilder_cached_image.cached.0.env is a list of "KEY=VALUE" strings, not a map. You can't merge() it directly. You'll need to either switch to env_map (the map equivalent exposed by the provider) or build the env list manually.

Questions for maintainers

1. Is this by design? The extra_env docs don't mention that unknown keys (from the perspective of the embedded library version) are silently dropped.
2. Will the provider be updated to embed a newer envbuilder version that includes GIT_SSH_PRIVATE_KEY_BASE64?
3. Alternatively, should extra_env pass unknown keys through to env_map as-is, so that the running container binary (which may be newer) can consume them?

Option 3 seems like the safest fix — extra_env is explicitly user-supplied, so acting as a transparent pass-through for unknown keys would be the least surprising behavior.

[alecsg77]

I apologize; this issue is a duplicate of issue #58.
This has been resolved with pull request #62.
However, the official release is still pending.