Build args does not take precedence over env variables between stages

[aimbot31]

Issue Description

Hello, I'm trying to build an image that use a default ENV variable inside its base and i'm trying to override it inside another image that inherits from the base, when i'm doing that, i'm not able to override the default ENV variable

Steps to reproduce the issue

Dockerfile used :

FROM docker.io/ubuntu:latest AS base

ENV VERSION=${VERSION:-2.0.0}
RUN echo ${VERSION}

FROM base

RUN echo ${VERSION}

RUN unset VERSION
ARG VERSION
RUN echo ${VERSION}
ENV VERSION=${VERSION}
RUN echo ${VERSION}
RUN VERSION=1 echo ${VERSION}

Command used :
buildah bud --file Dockerfile --build-arg VERSION='5.5'

Describe the results you received

[1/2] STEP 1/3: FROM docker.io/ubuntu:latest AS base
[1/2] STEP 2/3: ENV VERSION=${VERSION:-2.0.0}
[1/2] STEP 3/3: RUN echo ${VERSION}
2.0.0
Getting image source signatures
Copying blob 13b4428fd8e8 skipped: already exists  
Copying blob 5f70bf18a086 skipped: already exists  
Copying config 4d875b3a4c done   | 
Writing manifest to image destination
--> 4d875b3a4c2d
[2/2] STEP 1/8: FROM 4d875b3a4c2d33da9290885a8325f98df300cab8dabad752d459e420ad40d215
[2/2] STEP 2/8: RUN echo ${VERSION}
2.0.0
[2/2] STEP 3/8: RUN unset VERSION
[2/2] STEP 4/8: ARG VERSION
[2/2] STEP 5/8: RUN echo ${VERSION}
2.0.0
[2/2] STEP 6/8: ENV VERSION=${VERSION}
[2/2] STEP 7/8: RUN echo ${VERSION}
2.0.0
[2/2] STEP 8/8: RUN VERSION=1 echo ${VERSION}
2.0.0
[2/2] COMMIT
Getting image source signatures
Copying blob 13b4428fd8e8 skipped: already exists  
Copying blob 5f70bf18a086 skipped: already exists  
Copying blob 5f70bf18a086 skipped: already exists  
Copying config 97c9be4ba2 done   | 
Writing manifest to image destination
--> 97c9be4ba2fb

I'm not able to change the value of VERSION in the 2nd image that inherits from base

Describe the results you expected

When i'm building the same Dockerfile with docker :

 => [base 1/2] FROM docker.io/library/ubuntu:latest@sha256:353675e2a41babd526e2b837d7ec780c2a05bca0164f7ea5dbbd433d21d166fc                                                                                                                                                        0.0s
 => => resolve docker.io/library/ubuntu:latest@sha256:353675e2a41babd526e2b837d7ec780c2a05bca0164f7ea5dbbd433d21d166fc                                                                                                                                                             0.0s
 => CACHED [base 2/2] RUN echo 2.0.0                                                                                                                                                                                                                                               0.0s
 => CACHED [stage-1 1/5] RUN echo 2.0.0                                                                                                                                                                                                                                            0.0s
 => CACHED [stage-1 2/5] RUN unset VERSION                                                                                                                                                                                                                                         0.0s
 => [stage-1 3/5] RUN echo 5.5                                                                                                                                                                                                                                                     0.1s
 => [stage-1 4/5] RUN echo 5.5                                                                                                                                                                                                                                                     0.1s
 => [stage-1 5/5] RUN VERSION=1 echo 5.5                                                                                                                                                                                                                                           0.1s
 => exporting to image 

buildah version output

[build@9834284fc5ea ~]$ buildah version
Version:         1.41.4
Go Version:      go1.24.6
Image Spec:      1.1.1
Runtime Spec:    1.2.1
CNI Spec:        1.1.0
libcni Version:  
image Version:   5.36.2
Git Commit:      
Built:           Thu Sep  4 16:22:27 2025
OS/Arch:         linux/arm64
BuildPlatform:   linux/arm64/v8

buildah info output

[build@9834284fc5ea ~]$ buildah info
{
    "host": {
        "CgroupVersion": "v2",
        "Distribution": {
            "distribution": "fedora",
            "version": "42"
        },
        "MemFree": 2758561792,
        "MemTotal": 8217473024,
        "OCIRuntime": "crun",
        "SwapFree": 1073737728,
        "SwapTotal": 1073737728,
        "arch": "arm64",
        "cpus": 14,
        "hostname": "9834284fc5ea",
        "kernel": "6.10.14-linuxkit",
        "os": "linux",
        "rootless": true,
        "uptime": "20h 2m 2.29s (Approximately 0.83 days)",
        "variant": ""
    },
    "store": {
        "ContainerStore": {
            "number": 0
        },
        "GraphDriverName": "vfs",
        "GraphOptions": null,
        "GraphRoot": "/home/build/.local/share/containers/storage",
        "GraphStatus": {},
        "ImageStore": {
            "number": 13
        },
        "RunRoot": "/var/tmp/storage-run-1000/containers"
    }
}

Provide your storage.conf

[storage]
driver = "vfs"

Upstream Latest Release

Yes

Additional environment details

BUILDAH_ISOLATION=chroot

Additional information

running inside a container to do rootless build

[github-actions]

A friendly reminder that this issue had no activity for 30 days.