{"record":{"id":"f66478a8bb33fc29","repo":"microsoft/aspire","slug":"generated-deno-dockerfiles-do-not-support-env-file-because","errorCode":null,"errorMessage":"Generated Deno Dockerfiles do not support '--env-file' because dotenv files can contain secrets that would be copied into the container image. Use Aspire environment variables or secret parameters, or provide a custom Dockerfile that handles the file securely.","messagePattern":"Generated Deno Dockerfiles do not support '--env-file' because dotenv files can contain secrets that would be copied into the container image\\. Use Aspire environment variables or secret parameters, or provide a custom Dockerfile that handles the file securely\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.JavaScript/DenoHostingExtensions.cs","lineNumber":976,"sourceCode":"            !string.Equals(packageManager.ExecutableName, \"deno\", StringComparison.Ordinal))\n        {\n            throw new InvalidOperationException($\"Generated Deno Dockerfiles do not support alternate package manager '{packageManager.ExecutableName}'. Use WithDeno() or provide a custom Dockerfile.\");\n        }\n\n        if (resource.TryGetLastAnnotation<DenoCommandLineAnnotation>(out var deno) &&\n            deno.NodeModulesDirSet &&\n            deno.NodeModulesDirMode == DenoNodeModulesDirMode.Manual)\n        {\n            throw new InvalidOperationException(\"The 'manual' node_modules mode is not supported by generated Deno Dockerfiles because node_modules is excluded from the build context. Use the 'auto' mode or provide a custom Dockerfile.\");\n        }\n\n        if (deno is not null)\n        {\n            if (deno.RuntimeArgs.Any(argument =>\n                argument == \"--env-file\" ||\n                argument.StartsWith(\"--env-file=\", StringComparison.Ordinal)))\n            {\n                throw new InvalidOperationException(\n                    \"Generated Deno Dockerfiles do not support '--env-file' because dotenv files can contain secrets that would be copied into the container image. Use Aspire environment variables or secret parameters, or provide a custom Dockerfile that handles the file securely.\");\n            }\n\n            // The Docker build context is the app directory, so a path that is absolute or escapes the app\n            // directory is never copied into the image and would break both `deno cache` and the entrypoint.\n            ThrowIfPathEscapesDenoBuildContext(deno.ConfigFile, nameof(WithDenoConfig));\n            ThrowIfPathEscapesDenoBuildContext(deno.ImportMap, nameof(WithDenoImportMap));\n            ThrowIfPathEscapesDenoBuildContext(deno.Lock, nameof(WithDenoLock));\n        }\n    }\n\n    /// <summary>\n    /// Rejects a configured path that would resolve outside the generated Dockerfile's build context.\n    /// </summary>\n    /// <remarks>\n    /// Validation uses the same platform-independent normalizer as the generated Dockerfile. Both <c>/</c> and\n    /// <c>\\</c> are treated as separators so Windows rooted and UNC paths cannot become absolute only after they\n    /// are emitted into the Linux container. Traversal is resolved by depth: <c>config/../deno.json</c> stays","sourceCodeStart":958,"sourceCodeEnd":994,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.JavaScript/DenoHostingExtensions.cs#L958-L994","documentation":"The generated Deno Dockerfile bakes the build context into the image, so passing --env-file on the Deno command line would copy a dotenv file (which commonly holds secrets) into the container image layers. The library rejects this at build time and directs you to Aspire environment variables or secret parameters instead.","triggerScenarios":"Adding \"--env-file\" or \"--env-file=...\" to the Deno runtime arguments via WithDeno* methods (WithArgs/WithRuntimeArgs on the DenoCommandLineAnnotation), then generating the Dockerfile.","commonSituations":"A local dev workflow that loads .env via --env-file being carried over to container publish; secrets (.env with API keys) committed next to the app; replacing Aspire-managed environment configuration with a dotenv file.","solutions":["Remove the --env-file argument from the Deno command line.","Pass configuration via Aspire environment variables (WithEnvironment) or secret parameters (AddParameter(..., secret: true) / WithEnvironment with a parameter reference).","Provide a custom Dockerfile that injects the env file securely at runtime rather than build time."],"exampleFix":"// before\n.WithDeno(deno => deno.WithArgs(\"--env-file=.env\", \"run\", \"main.ts\"))\n// after\n.WithEnvironment(\"MY_SECRET\", builder.AddParameter(\"my-secret\", secret: true))\n .WithDeno(deno => deno.WithArgs(\"run\", \"main.ts\"))","handlingStrategy":"validation","validationCode":"// scan Deno runtime args for --env-file before publishing\nif (deno.RuntimeArgs.Any(a => a == \"--env-file\" || a.StartsWith(\"--env-file=\")))\n{\n    throw new InvalidOperationException(\"--env-file is unsupported in generated Deno Dockerfiles; use Aspire environment variables.\");\n}","typeGuard":null,"tryCatchPattern":"try\n{\n    app.WithDeno(deno => deno.WithArgs(\"run\", \"main.ts\"));\n}\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"--env-file\"))\n{\n    // migrate .env values to WithEnvironment / secret parameters\n}","preventionTips":["Never pass dotenv files via command-line flags into container images.","Use Aspire parameters (secret: true) and WithEnvironment for configuration and secrets.","Audit existing local Deno run scripts for --env-file before adding container publish."],"tags":["deno","dockerfile","secrets","env-file","security"],"backgroundTag":"missing-env-var","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}