Merge pull request #269 from dgageot/update-labels

Update the labels for secrets

Author: dgageot

pkg/config/mcp.go

@@ -1,10 +1,12 @@
 # syntax=docker/dockerfile:1
 
 FROM {{ .BaseImage }}
-LABEL com.docker.agent.mcp-servers="{{ .McpServers }}"
-LABEL com.docker.agent.models="{{ .Models }}"
-LABEL com.docker.agent.packaging.version="v0.0.1"
+
+LABEL com.docker.agent.packaging.version="v0.0.2"
 LABEL com.docker.agent.runtime="cagent"
+LABEL com.docker.agent.secrets.models="{{ .ModelSecrets }}"
+LABEL com.docker.agent.secrets.tools="{{ .ToolSecrets }}"
+
 LABEL org.opencontainers.image.author="{{ .Metadata.Author }}"
 LABEL org.opencontainers.image.created="{{ .BuildDate }}"
 LABEL org.opencontainers.image.description="{{ .Description }}"

pkg/config/models.go

@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"github.com/docker/cagent/pkg/config"
+	"github.com/docker/cagent/pkg/secrets"
 )
 
 //go:embed Dockerfile.template
@@ -40,8 +41,11 @@ func BuildDockerImage(ctx context.Context, agentFilePath, dockerImageName string
 	}
 
 	// Analyze the config to find which secrets are needed
-	modelNames := config.GatherModelNames(cfg)
-	mcpServers := config.GatherMCPServerReferences(cfg)
+	modelSecrets := secrets.GatherEnvVarsForModels(cfg)
+	toolSecrets, err := secrets.GatherEnvVarsForTools(ctx, cfg)
+	if err != nil {
+		return err
+	}
 
 	// Find which base image to use
 	baseImage := "docker/cagent"
@@ -54,13 +58,13 @@ func BuildDockerImage(ctx context.Context, agentFilePath, dockerImageName string
 
 	tpl := template.Must(template.New("Dockerfile").Parse(dockerfileTemplate))
 	if err := tpl.Execute(&dockerfileBuf, map[string]any{
-		"BaseImage":   baseImage,
-		"AgentConfig": string(agentYaml),
-		"BuildDate":   time.Now().UTC().Format(time.RFC3339),
-		"Description": cfg.Agents["root"].Description,
-		"McpServers":  strings.Join(mcpServers, ","),
-		"Metadata":    cfg.Metadata,
-		"Models":      strings.Join(modelNames, ","),
+		"BaseImage":    baseImage,
+		"AgentConfig":  string(agentYaml),
+		"BuildDate":    time.Now().UTC().Format(time.RFC3339),
+		"Description":  cfg.Agents["root"].Description,
+		"Metadata":     cfg.Metadata,
+		"ModelSecrets": strings.Join(modelSecrets, ","),
+		"ToolSecrets":  strings.Join(toolSecrets, ","),
 	}); err != nil {
 		return err
 	}

pkg/oci/Dockerfile.template

@@ -78,7 +78,7 @@ func GatherEnvVarsForModels(cfg *latest.Config) []string {
 func GatherEnvVarsForTools(ctx context.Context, cfg *latest.Config) ([]string, error) {
 	requiredEnv := map[string]bool{}
 
-	for _, ref := range config.GatherMCPServerReferences(cfg) {
+	for _, ref := range gatherMCPServerReferences(cfg) {
 		mcpServerName := gateway.ParseServerRef(ref)
 		if mcpServerURL := os.Getenv(mcp.ENV_DOCKER_MCP_URL_PREFIX + mcpServerName); mcpServerURL != "" {
 			// This MCP server is configured at runtime to be remote. We don't need to know its secrets.
@@ -98,6 +98,28 @@ func GatherEnvVarsForTools(ctx context.Context, cfg *latest.Config) ([]string, e
 	return mcpToSortedList(requiredEnv), nil
 }
 
+func gatherMCPServerReferences(cfg *latest.Config) []string {
+	servers := map[string]bool{}
+
+	for _, agent := range cfg.Agents {
+		for i := range agent.Toolsets {
+			toolSet := agent.Toolsets[i]
+
+			if toolSet.Type == "mcp" && toolSet.Ref != "" {
+				servers[toolSet.Ref] = true
+			}
+		}
+	}
+
+	var list []string
+	for e := range servers {
+		list = append(list, e)
+	}
+	sort.Strings(list)
+
+	return list
+}
+
 func mcpToSortedList(requiredEnv map[string]bool) []string {
 	var requiredEnvList []string