Description
Commit dc7bc4f ("NewStages(): only allow header args", first released in v1.2.12) narrowed the set of ARGs considered "globally allowed" for resolving a stage's FROM from every ARG declared anywhere in the file down to only ARGs appearing before the very first FROM (via extractHeadingArgsFromNode, which permanently stops collecting once it sees the first FROM).
Besides the stated goal ("the full set of ARGs declared in every stage" was too permissive), it seems to have a side effect: an ARG declared between two stages, after an earlier stage's body, but before a later stage's FROM, is no longer available to resolve that later FROM. That placement is not the same as a stage-local ARG; it's the documented Docker/BuildKit pattern for parameterizing a later stage's base image without hoisting the ARG to the very top of the file:
[An ARG] declared before a FROM ... can be used in any FROM instruction in the build.
(Docker docs, "Understand how ARG and FROM interact")
Docker's wording says "before a FROM," not "before the first FROM", i.e. it documents exactly the pattern this commit stopped supporting.
Reproduction
FROM scratch AS config
COPY somefile /build/
ARG UPSTREAM_IMAGE
FROM ${UPSTREAM_IMAGE} AS base
RUN echo "base stage ran"Building this with buildah bud --build-arg UPSTREAM_IMAGE=busybox ... (buildah ≥1.37, i.e. imagebuilder ≥1.2.12) fails: ${UPSTREAM_IMAGE} in the second FROM resolves to empty, and the caller (buildah) reports "no FROM statement found" because the resulting FROM line is blank. Moving the identical ARG UPSTREAM_IMAGE line above the first FROM fixes it with no other change. Ruled out as a factor: default values on the ARG, --build-arg presence, whether the earlier stage's output is consumed downstream, buildah's --skip-unused-stages, rootless vs rootful, storage driver. Full bisection and analysis (across buildah v1.29–v1.43) in the companion issue: podman-container-tools/buildah#7016.
Ask
Could NewStages()/extractHeadingArgsFromNode be adjusted to keep collecting ARG nodes that appear between stages (i.e., outside of any stage's own body, at the top level of the file) rather than stopping for good at the first FROM? That would preserve the original commit's goal, stage-local ARGs (declared after a FROM, inside a stage) still wouldn't leak to later stages, while restoring the documented "ARG before the FROM that uses it" pattern.
If the current, stricter behavior is intentional, it'd be worth a changelog/release-notes callout, since right now it fails silently with a message that gives no hint the cause is ARG placement.
Environment
Observed via buildah (which vendors this library): v1.37.0 through v1.45.0 all reproduce; v1.36.0 (imagebuilder v1.2.9) does not.
Description
Commit dc7bc4f ("NewStages(): only allow header args", first released in v1.2.12) narrowed the set of ARGs considered "globally allowed" for resolving a stage's
FROMfrom every ARG declared anywhere in the file down to only ARGs appearing before the very first FROM (viaextractHeadingArgsFromNode, which permanently stops collecting once it sees the firstFROM).Besides the stated goal ("the full set of ARGs declared in every stage" was too permissive), it seems to have a side effect: an
ARGdeclared between two stages, after an earlier stage's body, but before a later stage'sFROM, is no longer available to resolve that laterFROM. That placement is not the same as a stage-local ARG; it's the documented Docker/BuildKit pattern for parameterizing a later stage's base image without hoisting the ARG to the very top of the file:Docker's wording says "before a FROM," not "before the first FROM", i.e. it documents exactly the pattern this commit stopped supporting.
Reproduction
Building this with
buildah bud --build-arg UPSTREAM_IMAGE=busybox ...(buildah ≥1.37, i.e. imagebuilder ≥1.2.12) fails:${UPSTREAM_IMAGE}in the secondFROMresolves to empty, and the caller (buildah) reports "no FROM statement found" because the resulting FROM line is blank. Moving the identicalARG UPSTREAM_IMAGEline above the firstFROMfixes it with no other change. Ruled out as a factor: default values on the ARG,--build-argpresence, whether the earlier stage's output is consumed downstream, buildah's--skip-unused-stages, rootless vs rootful, storage driver. Full bisection and analysis (across buildah v1.29–v1.43) in the companion issue: podman-container-tools/buildah#7016.Ask
Could
NewStages()/extractHeadingArgsFromNodebe adjusted to keep collecting ARG nodes that appear between stages (i.e., outside of any stage's own body, at the top level of the file) rather than stopping for good at the firstFROM? That would preserve the original commit's goal, stage-local ARGs (declared after aFROM, inside a stage) still wouldn't leak to later stages, while restoring the documented "ARG before the FROM that uses it" pattern.If the current, stricter behavior is intentional, it'd be worth a changelog/release-notes callout, since right now it fails silently with a message that gives no hint the cause is ARG placement.
Environment
Observed via buildah (which vendors this library): v1.37.0 through v1.45.0 all reproduce; v1.36.0 (imagebuilder v1.2.9) does not.