From b5e2aae0e89aeea4908d6596a69584c7b3c4111c Mon Sep 17 00:00:00 2001
From: Trenton Holmes <797416+stumpylog@users.noreply.github.com>
Date: Sun, 9 Aug 2026 15:57:47 -0700
Subject: [PATCH] Feature: propagate resolved secrets to interactive container
 shells

---
 Dockerfile                             |  4 ++++
 docker/rootfs/etc/profile.d/contenv.sh | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100755 docker/rootfs/etc/profile.d/contenv.sh

diff --git a/Dockerfile b/Dockerfile
index 72b27f145..82efbe08e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -173,6 +173,10 @@ RUN set -eux \
         && rm --force --verbose *.deb \
     && rm --recursive --force --verbose /var/lib/apt/lists/*
 
+# Ensure interactive shells (docker exec bash) see resolved *_FILE secrets,
+# mirroring what with-contenv already does for s6 services.
+RUN echo '. /etc/profile.d/contenv.sh' >> /etc/bash.bashrc
+
 WORKDIR /usr/src/paperless/src/
 
 # Python dependencies
diff --git a/docker/rootfs/etc/profile.d/contenv.sh b/docker/rootfs/etc/profile.d/contenv.sh
new file mode 100755
index 000000000..be5f3ba1c
--- /dev/null
+++ b/docker/rootfs/etc/profile.d/contenv.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+# Source s6 container environment for interactive shells.
+# Ensures variables resolved from *_FILE secret injection are visible
+# when using 'docker exec bash'. Does not affect s6 services (those
+# use with-contenv directly). Has no effect in non-container contexts
+# because the directory will not exist.
+# Note: sh/dash shells opened via 'docker exec sh' are not covered;
+# only bash-based sessions benefit from this file.
+_pngx_contenv="/run/s6/container_environment"
+if [ -d "${_pngx_contenv}" ]; then
+	for _pngx_f in "${_pngx_contenv}"/*; do
+		[ -f "${_pngx_f}" ] || continue
+		_pngx_name=$(basename "${_pngx_f}")
+		_pngx_val=$(cat "${_pngx_f}")
+		export "${_pngx_name}=${_pngx_val}"
+	done
+fi
+unset _pngx_contenv _pngx_f _pngx_name _pngx_val