Secrets Not Properly Injecting When Using Docker Compose and No .env From Git.

[jtnishi]

Description

Potential regression arising from #296? Deploying a stack from git using docker compose, with no .env file committed in the repo, and manually loading in environment variables, including secrets, causes secrets to not be correctly injected into the container, and are injected as "***" literally instead.

Steps to Reproduce

1. Create a git repository with the intended docker compose file. DO NOT SET UP A COMMITTED .env
2. Set up dockhand with the repository and credentials (in my case, using fine-grained PAT)
3. Set up a deploy via git. Manually add environment variables, including secrets using the secrets flag
4. Deploy the stack via git.
5. Inspect the docker container from the side on the docker host using docker inspect (container_name)

Expected Behavior

Secrets should be injected into the container. While in the UI, they should be visible as only masked values, in the docker inspect, they should be visible due to being part of the environment.

Actual Behavior

The exposed environment variable with secrets is literally set to "***", the mask value.

Environment

• OS: Debian 13
• Version: v1.0.13 (digest sha256:ca7ef9fac79d7e978180d04984ca272f58127f27357e6c0f9263ae98089c2429)

Additional Information

Partial output of a docker inspect of an attempted started What's Up Docker container below. Certain elements redacted as {{REDACTED}} for protection. Of key note here is WUD_TRIGGER_DISCORD_DISCORDTRIGGER1_URL, WUD_AUTH_BASIC_MAIN_HASH, and WUD_REGISTRY_HUB_PUBLIC_PASSWORD, all of which are literally "***" in the docker inspect output for Env.

[
    {
        "Id": "27bb6db78dbd16d697819671834fb3b633f398f63c00a15df40de9bf5a1c4da0",
        "Created": "2026-01-28T12:13:33.488093773Z",
        "Path": "/usr/bin/entrypoint.sh",
        ...
        "Config": {
            "Hostname": "{{REDACTED}}",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": true,
            "AttachStderr": true,
            "ExposedPorts": {
                "3000/tcp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "WUD_TRIGGER_DISCORD_DISCORDTRIGGER1_URL=***",
                "WUD_TRIGGER_DISCORD_DISCORDTRIGGER1_BOTUSERNAME=What's Up Docker (Internal Test 3)",
                "WUD_WATCHER_LOCAL_CRON=32 3 * * *",
                "WUD_AUTH_BASIC_MAIN_USER={{REDACTED}}",
                "WUD_AUTH_BASIC_MAIN_HASH=***",
                "WUD_REGISTRY_HUB_PUBLIC_LOGIN={{REDACTED}}",
                "WUD_REGISTRY_HUB_PUBLIC_PASSWORD=***",
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "NODE_VERSION=23.11.1",
                "YARN_VERSION=1.22.22",
                "WORKDIR=/home/node/app",
                "WUD_LOG_FORMAT=text",
                "WUD_VERSION=8.1.1"
            ],
        ...
    }
]

[jtnishi]

Also, for reference, placing the compose I used to deploy. As can be seen, the 3 environment variables that I intend to be masked are marked in the environment section of the compose file, but I do not commit a .env file at this point yet, since I'm still trying to understand a bit how dockhand handles .env, which of course is changing in ways like #296

services:
  whatsupdocker:
    image: getwud/wud
    container_name: whats-up-docker
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    # ports:
    #   - 3000:3000
    environment:
      WUD_AUTH_BASIC_MAIN_USER: "${WUD_AUTH_BASIC_MAIN_USER:?Username for main user must be set}"
      WUD_AUTH_BASIC_MAIN_HASH: "${WUD_AUTH_BASIC_MAIN_HASH:?Hashed password for main user must be set}"
      WUD_REGISTRY_HUB_PUBLIC_LOGIN: "${WUD_REGISTRY_HUB_PUBLIC_LOGIN:?Login name for hub.docker must be set}"
      WUD_REGISTRY_HUB_PUBLIC_PASSWORD: "${WUD_REGISTRY_HUB_PUBLIC_PASSWORD:?Token for hub.docker must be set}"
      WUD_TRIGGER_DISCORD_DISCORDTRIGGER1_URL: "${WUD_TRIGGER_DISCORD_DISCORDTRIGGER1_URL:?API Webhook URL for Discord must be set}"
      WUD_TRIGGER_DISCORD_DISCORDTRIGGER1_BOTUSERNAME: "${WUD_TRIGGER_DISCORD_DISCORDTRIGGER1_BOTUSERNAME:-What's Up Docker}"
      WUD_WATCHER_LOCAL_CRON: "${WUD_WATCHER_LOCAL_CRON:-10 0 * * *}"
    networks:
      - default
      - proxy
    restart: unless-stopped
    healthcheck:
      test: curl --fail http://localhost:${WUD_SERVER_PORT:-3000}/health || exit 1
      interval: 10s
      timeout: 10s
      retries: 3
      start_period: 10s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whats-up-docker.rule=Host(`wud.${MAIN_DOMAIN_NAME:?Domain Name Was Not Declared}`)"
      - "traefik.http.routers.whats-up-docker.entrypoints=websecure"
      - "traefik.http.routers.whats-up-docker.tls=true"

      # What's Up Docker
      - 'wud.tag.include=^\d+\.\d+\.\d+$$'
      - "wud.link.template=https://github.com/getwud/wud/releases/tag/$${major}.$${minor}.$${patch}"

networks:
  default:
  proxy:
    external: true

[jotka]

hi @jtnishi of course a regression slipped in during the refactoring in #296 . thanks for the report! I'm on it.

[jtnishi]

Per #371, fnsys/dockhand:b3342297 after a bit of checking does also appear to fix this bug as well. Thank you for your work on this!

[jotka]

hi @jtnishi closing this one, as v1.0.14 has been released and contains the fix. thanks for your effort in testing and great feedback reports!

[spuder]

Update

Most likely this issue: #1018

---

Interestingly I'm still seeing this behavior on 1.0.14

docker image inspect fnsys/dockhand:latest
[
    {
        "Id": "sha256:fd1a5e9c69afbb053a6e795e3fc10c6f6bbaa43b7863bf349c14eeb981ed3e3c",
        "RepoTags": [
            "fnsys/dockhand:latest"
        ],
        "RepoDigests": [
            "fnsys/dockhand@sha256:656ae5ed674d79b8251de275ae4259043f60222bbab563c71ed8dd91edd0b660"
        ],
        "Comment": "buildkit.dockerfile.v0",
        "Created": "2026-05-16T09:57:36.404908957Z",