Support for .env files

[vladaionescu]

A feature request is the support for .env files (similar to how compose uses them https://docs.docker.com/compose/env-file/).

It might work like this: if an .env file is present in the current dir, or any dir above the current dir (dirs closer to current dir have higher precendence), load the vars and pass them to the build as both build-args AND secrets. EDIT: Using the .env in the current dir only seems to be the the behavior most similar to how other tools work.

CC @zenyui

[zenyui]

this aligns well with docker-compose local dev, as it's a common pattern to supply a .env for easy propagation of environment variables into containers. It would be especially helpful for passing in development secrets to earth, as it would eliminate the need for pre-setting those values as env vars or passing into the build command as plaintext.

[vladaionescu]

Indeed - we've been debating whether to support this because we have upcoming cloud-based features that serve the same use-case. But I think it's still worth doing it, as not everyone will be comfortable with hosting secrets outside their own environment.

[vladaionescu]

This will go in next week's release, @zenyui

[winmillwill]

@vladaionescu what is the implication of copying a potentially secret environment variable from .env to the build args? Do those build args not show up in the image history or similar? What's the motivation for copying to both build args and secrets?

[vladaionescu]

The build args only show up in the history if they are declared as such via ARG. But if an arg is passed on the command-line, but is never used in the build with an ARG declaration, then it will not show up.

[frafra]

Might I add that using .env files for earthly clashes with using .env files for docker compose? I was a bit puzzled to see my .env variables in the output produced by earthly (passwords too).

[alexcb]

@frafra I opened #1736 to track env variables being output when a target doesn't exist (or interupted by ctrl-c).

If there's another case where they are displayed when not explicitly requested via an ARG ..., would you mind opening a new issue?