DEFAULT_CONFTEST_VERSION should be available at runtime

[nvanheuverzwijn]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

---

Overview of the Issue

When starting atlantis version 0.36.0 (0.37.1 is affected as well), DEFAULT_CONFTEST_VERSION is not defined. This will always print the info log failed to get default conftest version. Will attempt request scoped lazy loads DEFAULT_CONFTEST_VERSION not set. Starting atlantis with default configuration should not log errors like this. DEFAULT_CONFTEST_VERSION should be available in runtime, especially because we use this environment variable to download conftest on build time.

Reproduction Steps

Executing this will print out the error log.

docker run -it ghcr.io/runatlantis/atlantis:v0.36.0 atlantis server --gh-user=test --gh-token=test --repo-allowlist=test

Logs

Environment details

atlantis version: 0.36 and 0.37.1

Additional Context

We should add DEFAULT_CONFTEST_VERSION available to stock container image. The source code is using this environment variable so it should always be defined with a default value. The operator should explicitly unset the environment variable if he wants to keep this behavior. I think it's unreasonable to have to specify DEFAULT_CONFTEST_VERSION, especially since we download conftest at build time using this variable.

[dosubot]

The reason you see the log message about DEFAULT_CONFTEST_VERSION not being set is that, while the Dockerfile defines this variable as a build argument (with a default value, e.g., 0.63.0) and uses it to download the conftest binary during the build, it does not guarantee that the environment variable is present in the final runtime container environment. The Atlantis code expects DEFAULT_CONFTEST_VERSION to be set at runtime; if it's missing, you get the info log and policy checks may not work as expected. There is no fallback default in the code itself—if the variable is unset, Atlantis tries to fall back to a local conftest binary, or logs the error if that's not available either (source).

To avoid this, set DEFAULT_CONFTEST_VERSION explicitly when running the container, for example:

docker run -e DEFAULT_CONFTEST_VERSION=0.63.0 -it ghcr.io/runatlantis/atlantis:v0.36.0 atlantis server ...

Or, if using Helm, set it in your values file or with extraEnv so it's available at runtime.

For maintainers: it would be more robust for the Dockerfile to set DEFAULT_CONFTEST_VERSION as an ENV in the final image, or for the code to provide a fallback default if the variable is unset at runtime. This would prevent the log message and ensure consistent policy check behavior out of the box (source).

This issue is confirmed by other users and affects policy check functionality (thread).

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}