Javacode fails to read dotted environment variables since 08/09/23

[kreuzkoenig]

Hello all,

we have noticed that since about 2 days our java servlet cannot read environment variables which have a "." in the name.

Short example:
System.getenv("variable.with.a.dot") returns null

where
System.getenv("variablewithoutdot") returns the correct variable value.

We set the environment variables via the docker compose .env file.

Is this a known issue or does anyone know why the behavior has changed recently?

// Edit: added used version

version name:   Apache Tomcat/9.0.78
Server version number: 9.0.78.0
OS Name:               Linux
OS Version:            5.15.90.1-microsoft-standard-WSL2
Architecture:          amd64
Java Home:             /opt/java/openjdk
JVM Version:           11.0.20+8
JVM Vendor:            Eclipse Adoptium

Thank you very much for your help and hints.

[mvestola]

We have exactly same issue so I think this is a real issue. I am running in kubernetes tomcat based docker image using tomcat:9.0-jdk17-temurin-focal. Environment variables are passed as configmap and some environment variables have dotted notation in the key name like my.key=myValue. So this setup is using these versions:

OpenJDK Runtime Environment Temurin-17.0.8+7 (build 17.0.8+7)
Server version: Apache Tomcat/9.0.78
Server number:  9.0.78.0
OS Name:        Linux
OS Version:     5.15.0-69-generic
Architecture:   amd64
JVM Version:    17.0.8+7
JVM Vendor:     Eclipse Adoptium

Based on my investigation, I think 9.0.78 docker image was already released about a month ago since we have been running 9.0.78 tomcat about a month ago already. Everything was working fine at that time. But a few days ago there was an image push with the same tag name and since that 9.0.78 docker image is unable to read these dotted environment variables. At least that is how I have interpreted this one which shows last push 2 days ago: https://hub.docker.com/layers/library/tomcat/9.0-jdk17-temurin-focal/images/sha256-546ed8e4e0eb770203b713be7a0de3905d3cf8a7d25df22683479f8af5994814?context=explore .

Even though dotted environment variables are not really recommended, they should be perfectly valid to be used.

[mvestola]

Current fix I have made is to switch back to image tomcat:9.0.76-jdk17-temurin-focal which does not have this issue. But this should be fixed for the 9.0.78 image.

[yosifkit]

As you can see from the Dockerfiles, we have haven't changed anything directly in the tomcat image. This sounds very much like #77. The recent images updates are caused by changes/updates in the eclipse-temurin images (which we then rebuild official-images FROM them).

After reviewing the changes added in the eclipse-temurin images (specifically docker-library/official-images#15162 which means adoptium/containers#392 is included in all temurin images), I see that some of their entrypoint scripts are running sh which is the exact cause of #77. I'll go file an issue over there to fix it (so other images don't hit this too) and I'll make a PR to apply a fix here. If you set both ENTRYPOINT and CMD, you can work around it, like this:

$ docker run -it --rm -e 'variable.with.a.dot=foo' tomcat:9.0-jdk17-temurin-focal env | grep foo
[no output]
$ docker run -it --rm -e 'variable.with.a.dot=foo' --entrypoint='' tomcat:9.0-jdk17-temurin-focal env | grep foo
variable.with.a.dot=foo

$ # really you'll have to set something like this to run tomcat:
$ docker run -it --rm -e 'variable.with.a.dot=foo' --entrypoint='' tomcat:9.0-jdk17-temurin-focal catalina.sh run
$ # or this
$ docker run -it --rm -e 'variable.with.a.dot=foo' --entrypoint=catalina.sh tomcat:9.0-jdk17-temurin-focal run