# Redact environment secrets from dev container \`docker exec\` logs \(\#63606\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/1057c2cf3d5b4aefd04755e1387c7826a4d7fba6)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 1057c2cf3d5b4aefd04755e1387c7826a4d7fba6

Requested commit: 1057c2cf3d5b4aefd04755e1387c7826a4d7fba6

Commit: 1057c2cf3d5b4aefd04755e1387c7826a4d7fba6

Tree: 2155bc6eb534fd1608c88064713af2830558c5d9

Author: Coinleft LFT

Committer: GitHub

## Message

```
Redact environment secrets from dev container `docker exec` logs (#63606)

# Objective

Fixes #63569

`run_docker_command` Debug-formatted the whole `docker exec` command, so
every `-e NAME=VALUE` pair forwarded into a dev container was written to
`Zed.log` in plaintext: once at DEBUG, and again in the error message
that `remote_client.rs` logs at ERROR on a failed reconnect.

## Solution

Render the command with `redact_arguments`, which replaces the value of
every `-e NAME=VALUE` argument with `<redacted>` before the arguments
are flattened, and pass the remaining arguments and stderr through
`util::redact::redact_command`.
Validate `containerEnv` and `remoteEnv` keys in `spawn_dev_container`
before any container is reused or built, because an empty key produced
`-e =VALUE`, which the Docker CLI rejects while echoing the value
verbatim to stderr.
Skip invalid names in `remote` as well, since `remote_env` is also
rehydrated from the workspace database.
The shared predicate lives in `util::redact::is_valid_environment_name`.

The DEBUG line now logs the redacted command and exit status only; the
previous stdout and stderr byte dumps are gone.

## Testing

`cargo test -p remote -p dev_container --lib`.
Unit tests cover redaction of forwarded env, argument boundaries,
assignments inside program arguments and stderr, invalid-name skipping
and rejection, and the podman CLI.

Release Notes:

- Fixed dev container environment variables being logged in full

---------

Co-authored-by: Kirill Bulatov <mail4score@gmail.com>
```

## Parents

- [206a863a95086699f2a8784a58b4825af80df46c](https://git.cafe/gitcafe/zed/commit/206a863a95086699f2a8784a58b4825af80df46c?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/1057c2cf3d5b4aefd04755e1387c7826a4d7fba6?format=markdown)