Fix build slowdown when OpenTelemetry Exporter env variables are present

[maxproske]

Closes #13157

Fixes a 10s slowdown on docker compose build, including cached builds, when OTEL_EXPORTER_* or OTEL_*_EXPORTER env variables are present. Scrubs OpenTelemetry env variables when shelling out to bake.

Bake was called with the full project environment. When a user's .env file include OpenTelemetry exporter env variables (eg. OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318), these were passed to buildx, which attempted to init its OTLP exporter and connect to an unreachable collector, making the process wait for a network timeout. For the user, this was during the "resolving provenance for metadata file" step visually.

This is a short-term hotfix for the immediate issue, before more projects opt-out of Compose bake with COMPOSE_BAKE=false. A better long term solution might be to sanitize the bake env with a minimal allowlist (eg. DOCKER_, BUILDX_, etc.) or update hasOtelEndpointInEnv detection in internal/tracing.

Steps to reproduce

cat > Dockerfile <<EOF
FROM alpine
EOF

cat > compose.yaml <<EOF
services:
  app:
    build: .
EOF

cat > .env <<EOF
OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318
EOF

echo "--- Slow ---"
time docker compose build
# 11 seconds

echo "--- Fast ---"
time COMPOSE_BAKE=false docker compose build
# 0.5 seconds

echo "--- Fast ---"
rm .env
time docker compose build
# 0.5 seconds

[ndeloof]

:-1 This fix would disable Otel tracing for all users, just to prevent a delay for a corner case (OTEL_* variable set in .env with an unreachable target).

[maxproske]

Ah, thank you @ndeloof, I was hoping to only catch .env/--env-file sourced variables, but this was more aggressive?

The core issue, as I see it, is although Compose has always merged .env into its own environment, the timeout only occurs when Bake is enabled -- That degraded change is what I want to solve.

Because without a way to scope env variables to services only, users are unknowingly penalized for using Compose as an orchestrator for a CNCF project (OTel) just because Docker happens to use it too, and end up disabling Bake mozilla/bedrock#16464

What do you suggest, or can this PR be closed as superseded by #13180?

[glours]

superseded by #13180