From 5abfca19b31281ccf8aa96f0dfb109ac391815e1 Mon Sep 17 00:00:00 2001
From: Timothy Kim <timothykim@fastmail.fm>
Date: Fri, 20 Mar 2026 16:25:23 -0400
Subject: [PATCH] restrict envsubst to expected variables only

---
 docker/garage/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/garage/Dockerfile b/docker/garage/Dockerfile
index cf31ebc..a2997cb 100644
--- a/docker/garage/Dockerfile
+++ b/docker/garage/Dockerfile
@@ -5,4 +5,4 @@ FROM base
 COPY --from=dxflrs/garage:v2.2.0 /garage /garage
 COPY garage.toml /etc/garage.toml.tpl
 
-CMD envsubst < /etc/garage.toml.tpl > /etc/garage.toml && exec /garage server
+CMD envsubst '${RPC_SECRET} ${ARGENTO_NODE_ID} ${ADMIN_TOKEN}' < /etc/garage.toml.tpl > /etc/garage.toml && exec /garage server