[BUG] Pass `--secret` option when building an image

[edouardruiz]

Hi,

Is it possible to pass the --secret option when building an image with the python client? It works with podman CLI with or without the --remote option and I can mount the secret when building the image.

[gsilva00]

Hi, I'm also interested in this feature. What is the current state of this?

My use case is automating the creation of multi‑architecture container images with podman. Sometimes I need to pass secrets (and SSH agents/keys) to the build context, using the mount types.

With the Podman CLI, I could do this:

$ podman build \
  --manifest=example:v1.0.0 \
  --platform=linux/amd64,linux/arm64 \
  --ssh=default \
  --secret=id=mysecret1,src=/path/to/secret1 \
  --secret=id=mysecret2,src=/path/to/secret2 \
  .

However, when converting this to podman-py, the --ssh and --secret options are not available in the client.images.build() method.

---

I'm fairly new to containerization, but especially to Podman, so please correct me if I'm wrong on my research of the Podman API:

The --manifest option, for example, can be passed to the params in the POST request and works out of the box, because it's expected by the Podman API, (see #596).

From my testing, however, the --ssh and --secret options are not part of the API POST request at all, when using --remote. Moreover, their usage in RUN --mount=type=ssh/RUN --mount=type=secret, respectively, fails during the build.
I wondered if these options might be handled differently (outside the POST request) due to their sensitive nature, but if so, why would the build fail anyway?

Due to its reliance on the Podman API, I believe that this might pose a problem for podman-py.

My testing setup:

• podman system service --time=0 tcp://localhost:8888 +
• podman system connection add debug tcp://localhost:8888 +
• --remote --connection=debug on the previous podman build command +
• --log-level=debug to see the requests being made to the service +
• Inspected HTTP requests with Wireshark / tcpdump

---

I also found this related buildah discussion: containers/buildah#3409 (comment) (not sure if the stance on this has changed since then).

So, my question is:

Is this feature an impossibility due to design or technical limitations from upstream, or could it be implemented in podman-py?
Same question for the --secret option and its use with --mount=type=secret, considering the difficulty of sharing secret files or environment variables with a remote service.

Thanks a lot for your time and help!

[inknos]

hey all,

About --secret I believe it should be possible to implement it in a similar way as --manifest

In fact, if you try and do podman-remote --url unix://... build --secret=id=mysecret you get:

POST/v5.7.0/libpod/build?... &secrets=["id=mysecret"]&...

Regarding mount, I believe it will be the same, but I am not familiar with the implementation, so there might be some hiccups.

Given the major interest this feature is getting, I am willing to use some time to work on it, unless you don't want to pick it up. it should be fairly straightforward to implement, and I can help with reviews if you need.

[gsilva00]

Hi, thank you very much for taking the time to look into this!

Confirmed your findings. My wrong results came from an old Podman (v3.4.4) that supported --secret locally but not remotely.
Updated to Podman v5.6.2 — secrets are now correctly passed via API.

---

Question: Why does your POST request use v5.7.0 in the URL if the latest release is v5.6.2?
Is it related to podman-remote?
Are you using a dev build?

---

Should I open a new issue to discuss --ssh?

---

In any case, I'm interested in opening a PR for this.
If you don't mind, I will tackle it as soon as I can.

[inknos]

Question: Why does your POST request use v5.7.0 in the URL if the latest release is v5.6.2?

I am running podman-5.7.0~dev-1.20251007192320087914.main.1702.7fecff5c29.fc42.x86_64 from podman-next