Set secret/config uid:gid to match container's USER #13288

ndeloof · 2025-10-15T09:14:15Z

What I did

if no explicit uid/gid is set for secret/config mount, use container's USER to enforce secret is accessible by container's process

Related issue
fixes #13287

(not mandatory) A picture of a cute animal, if possible in relation to what you did

Signed-off-by: Nicolas De Loof <[email protected]>

codecov · 2025-10-15T13:55:57Z

Codecov Report

❌ Patch coverage is 77.27273% with 20 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/compose/secrets.go	79.26%	11 Missing and 6 partials ⚠️
pkg/compose/run.go	50.00%	2 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

glours

Sounds good to me!
What if we add a test with UID:GID with fileTargetset?

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [docker/compose](https://github.com/docker/compose) | patch | `v2.40.0` -> `v2.40.1` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>docker/compose (docker/compose)</summary> ### [`v2.40.1`](https://github.com/docker/compose/releases/tag/v2.40.1) [Compare Source](docker/compose@v2.40.0...v2.40.1) #### What's Changed ##### ✨ Improvements ##### 🐛 Fixes - Write error to watcher error channel if Start() fails by [@Trolldemorted](https://github.com/Trolldemorted) in [#13263](docker/compose#13263) - Fix: set PWD only if not set by [@kianelbo](https://github.com/kianelbo) in [#13268](docker/compose#13268) - bake only interpolates ${\*} by [@ndeloof](https://github.com/ndeloof) in [#13270](docker/compose#13270) - Fix: make "publish" push all compose files addressed in "extends" statements when using "profiles". by [@ogoulpeau-ledger](https://github.com/ogoulpeau-ledger) in [#13277](docker/compose#13277) - Support Ctrl+Z to run compose in background by [@ndeloof](https://github.com/ndeloof) in [#13289](docker/compose#13289) - Fix race-condition bug in publish command by [@paul-kinexon](https://github.com/paul-kinexon) in [#13291](docker/compose#13291) - Set secret/config uid:gid to match container's USER by [@ndeloof](https://github.com/ndeloof) in [#13288](docker/compose#13288) - Fix failure to delegate build with bake by [@ndeloof](https://github.com/ndeloof) in [#13275](docker/compose#13275) - Make CTRL+Z a no-op operation on Windows by [@glours](https://github.com/glours) in [#13293](docker/compose#13293) ##### 🔧 Internal - pkg/compose: align classic builder implementation with docker/cli by [@thaJeztah](https://github.com/thaJeztah) in [#13278](docker/compose#13278) - pkg/compose: build with bake: drop support for buildx v0.16 and lower by [@thaJeztah](https://github.com/thaJeztah) in [#13280](docker/compose#13280) - Use fixed version of compose bridge transformer images by [@glours](https://github.com/glours) in [#13284](docker/compose#13284) ##### ⚙️ Dependencies - Build(deps): bump github.com/docker/docker from 28.5.0+incompatible to 28.5.1+incompatible by [@dependabot](https://github.com/dependabot)\[bot] in [#13274](docker/compose#13274) - Build(deps): bump github.com/docker/cli from 28.5.0+incompatible to 28.5.1+incompatible by [@dependabot](https://github.com/dependabot)\[bot] in [#13273](docker/compose#13273) - Build(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#13272](docker/compose#13272) - Build(deps): bump docker/buildx v0.29.1, moby/buildkit v0.25.1 by [@thaJeztah](https://github.com/thaJeztah) in [#13279](docker/compose#13279) - Bump golang to version 1.24.9 by [@glours](https://github.com/glours) in [#13285](docker/compose#13285) #### New Contributors - [@Trolldemorted](https://github.com/Trolldemorted) made their first contribution in [#13263](docker/compose#13263) - [@ogoulpeau-ledger](https://github.com/ogoulpeau-ledger) made their first contribution in [#13277](docker/compose#13277) - [@paul-kinexon](https://github.com/paul-kinexon) made their first contribution in [#13291](docker/compose#13291) **Full Changelog**: <docker/compose@v2.40.0...v2.40.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever MR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

as we can't get container UID/GID as int by ContainerInspect revert docker#13288 Signed-off-by: Nicolas De Loof <[email protected]>

as we can't get container UID/GID as int by ContainerInspect revert #13288 Signed-off-by: Nicolas De Loof <[email protected]>

Bumping compose to version v2.26.1-849-g9fada6cc2, which comprises the following commits: 9fada6cc2 Bumped build images: tonistiigi/xx:1.9.0, crazymax/osxcross:15.5 85ea24b62 Fix grammar: pluralize 'service' and remove apostrophes in lets 000a4a4b9 check buildx version before comparing it 08de90c26 bump golang 1.24.11 cfcee45a8 fix SDK example 13d70b1c1 refactor: replace interface{} with any for clarity and modernization 72f4d655e Bump compose go to v2.10.0 dc66e6bad golangci-lint: use gci formatter instead of goimports 8d9d5259e Fix grammar: change 'adopted' to 'adopt' in Docker Swarm note b32297dcc add --wait option to start command af8cac576 just warn user 8477a85ce feat(model): reject runtime flags in model configuration 6ee714635 build(deps): bump golang.org/x/crypto v0.45.0 f28503426 build(deps): bump github.com/hashicorp/go-version from 1.7.0 to 1.8.0 e0977c2df only check for env_file 2d569916f skip includes preparing publish 3975f0215 refactor: use strings.Builder to improve performance fa832d72d Added support for build.no_cache_filter 822f5a702 refactor: replace Split in loops with more efficient SplitSeq 68bb7a71b bump dependencies 6f365395e Fix support for port range 305293462 build(deps): bump github.com/docker/buildx from v0.29.1 to v0.30.0 428abab16 build(deps): bump github.com/moby/buildkit from v0.25.2 to v0.26.0 755618e70 build(deps): bump go.opentelemetry.io/otel v1.38.0, go.opentelemetry.io/contrib v0.63.0 c47b8c32e Dockerfile: update golangci-lint to v2.6.2 89d394483 fix linting issues f2b14fe1a gha: use custom names for matrix bd2257b6d gha: test against docker v29, v28 d7e5f20eb images command should display image Created time or N/A if not available 2b4543935 next release will be major version v5.x f0dce1b97 sdk docs: patch 6e55832b1 add (restore) support for detach keys 45def5111 make DRYRUN_PREFIX a display attribute, move DryRunClient out of pkg/api aff5c115d move progress UI components into cmd 5ef495c89 removed unecessary check 9de7e2a38 SDK docs dc90c4e44 Grammatical fix 91e1753d8 Grammatical fix 9db27a65c Making the American/British spellings consistent to the error messages efd7424da build(deps): bump golang.org/x/sync from 0.17.0 to 0.18.0 02109c8d3 build(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 c37ede62d on up buildOptions must include all enabled services 7eb5adeef introduce --insecure-registry, reserved for testing purpose 0793ad7c6 document support for OCI and Git remote resources 8137b2bce build(deps): bump github.com/docker/cli 4e3372b47 build(deps): bump github.com/containerd/containerd/v2 fef26fb37 build(deps): bump github.com/docker/docker a32e13a2b build(deps): bump github.com/moby/buildkit from 0.25.1 to 0.25.2 67e39a41f fixes dc1283289 fix: use NewParallelCLI in compose_run_build_once_test.go 0c596ed3c build(deps): bump github.com/containerd/platforms 13870006f disable progress UI when build is ran with --print af579ebd4 drop support for internal buildkit builder fc2a7d13f from Compose CLI, we know the streams used to configure LogConsumer d70bb8cf5 distinguish event (short) status text and details bff3d3530 render events in order they were first received b80bb0586 Migrate CLI commands to use LoadProject API d74274bc0 Add LoadProject method to Compose SDK API 10f15cacd fix typo in error message 3658a063b add AlwaysOkPrompt to replace 'AlwaysYes' current implementation' 74a4ccdd8 fix various linting issues 6719f47bd test checking bake internal load build definition 3eb2934eb bump compose-go to version v2.9.1 c416ea703 fix compose_run_build_once_test.go 0d396bbac fix(git): Add validation for Git subdirectory paths to prevent traversal fc74c7896 Update e2e tests in compose_run_build_once_test.go to use project names for Docker Compose commands. 658bff335 Revert "no parallel in compose_run_build_once_test.go" 80030e139 no parallel in compose_run_build_once_test.go 6a35be511 lint fix 0c854a6ab add e2e tests 557e0b6ec fix(run): Ensure images exist only for the target service in run command a8933c91e stop progress UI during build to prevent interference with buildkit Display 7e3993bca skip Start[ed|ing] events to avpd mix with container logs fd4f2f99c register TTYWritter as an Event Processor ae25d27e5 remove unused RunWithStatus, always pass operation as title 394466683 use eventBus to collect tasks progress e5c8b6864 decouple Event from tty progress writer bf50c9919 pretend cli.Out is a containerd console.File 8274be8d0 configure Compose service with io.Reader and io.Writer remove usage of internal IO interfaces 86e91e010 Add streamOverrideWrapper to intercepts command.Cli stream methods and transparently returns custom streams when provided via options Add new GetConfiguredStreams function to Compose API definition e1678c5c4 Introduce abstractions to support SDK usage without requiring Docker CLI 5924387e8 run hooks on restart 7f668bd7f Setup Compose service using functional parameters This commit introduces WithMaxConcurrency and WithDryRun to replace direct mutators on composeService commands and flags are translated into a set of functional parameters which are eventually applied as a ComposeService is created just before being actually used by a command 3ce52883c prompt default implementation to prevent a panic ac3b8fd8a Code Cleanup 8619f5d72 Fix help output for "exec --no-tty" option e59150baa fix OCI compose override support 6a90742ef Test to check writeComposeFile detects invalid OCI artifact 6007d4c7e publish env_file references as opaque hash to prevent paths conflicts 69bcb962b Enforce compose files from OCI artifact all get into the same target (cache) folder 9b4fcce03 introduce WithPrompt to configure compose backend to use a plugable UI component for user interaction da5c57c29 test digest or canonical reference, not only tag, when checking if an image is already present e25265dd5 remove unused code to only rely on api.Service e19e1278b fail build if minimal required version of buildx isn't installed 585c4db4f Compose can't create a tar with adequate uid:gid ownership as we can't get container UID/GID as int by ContainerInspect revert docker/compose#13288 be8c7e6c6 make CTRL+Z a no-op operation on Windows 27f59d7f4 Detect failure to access os.TempDir 2681ed17a mutualize code from injectSecrets / injectConfigs ee75be342 Set secret/config uid:gid to match container's USER 157617480 fix race-condition bug in publish command 88aae9c46 support Ctrl+Z to run compose in background 775530234 use fixed version of compose bridge transformer images to avoid CI issue on Compose when a new version is released and change the outputs 147923c44 bump golang to version 1.24.9 289faae5f fix(publish): in `publish()`, select all profiles in the `project` to publish. e7aa484b7 fix(publish): in `processFile()`, load the compose file passing the `project.Profiles` to the `loader.Options`. ae3309afa pkg/compose: build with bake: drop support for buildx v0.16 and lower 0b5fb36eb build(deps): bump docker/buildx v0.29.1, moby/buildkit v0.25.1 63920c4cc pkg/compose: align classic builder implementation with docker/cli a03f2562d bake only interpolates ${*} a07f2b8de build(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 f45a3ebcf build(deps): bump github.com/docker/cli 7fec70b6c build(deps): bump github.com/docker/docker ce463d50b Fix: set PWD only if not set fa7e85ed8 Write error to watcher error channel if Start() fails d9423f687 build(deps): bump github.com/docker/cli 5add90240 build(deps): bump github.com/docker/docker 07602f207 publish Compose application as compose.yaml + images cf7e31f73 escape $ in bake.json as interpolation already has been managed by compose fa0812745 use containerd client for OCI operations 4ee52ad16 pass bake secrets by env 4a4776ec5 cmd/compose: fix minor linting issues 713de5bb9 pkg/compose: explicitly map AuthConfig fields instead of a direct cast 9ded1684c gha: update test-matrix: remove docker 26.x 8bc8593fd provider services: use '--project-name=' notation 8978c1027 use containerd registry client 032e0309e cmd: pluginMain: use WithUserAgent option 38ba35e16 pkg/mocks: re-generate mocks 56e0ba808 build(deps): bump github.com/docker/docker, docker/cli v28.5.0-rc.1 9752fa550 pluginMain: remove uses of DockerCLI.Apply 4761fd88b pkg/compose: build: remove permissions warning on Windows 02c8e6354 pkg/watch: remove unused IsWindowsShortReadError ab7a6e932 pkg/compose: remove uses of deprecated mitchellh/mapstructure module 2ca7b96e3 resolve secrets based on env var before executing bake a32dc3da7 test: Set stop_signal to SIGTERM db260938c bump compose-go to version v2.9.0 5aea94794 Update comment on run command with tty & piped command d07c437ce dectect if piped run command and disable tty if so da72230c3 remove tty attribute from run options and use dedicated variable to avoid confusion a429c09df fix support for build with bake when target docker endpoint requires TLS df3c27c86 add deprecation warning for x-initialSync + e2e test 956891af5 add support of develop.watch.initial_sync attribute a47334105 volume ls command can run without a project 385b3f5c9 bump compose-go to version v2.8.2 2d482e61c propagate docker endpoint to bake using DOCKER_* env variables c75418ee0 Apply suggestions from code review 0cdc5c9bf rename --no-TTY => --no-tty for consistency b768232c0 document (hidden) --tty --interactive flags 09689400e fix run --build support for service:* reference in additional_context cb3691154 detect container is restarted b387ba4a0 only load COMPOSE_* from $PWD/.env 7cd569922 only propagate os.Env to bake, not the whole project.Environment eec2bb7ea only force plain mode build if progress is set to auto 2c15aef2e build(deps): bump golang.org/x/sys from 0.35.0 to 0.36.0 290366205 build(deps): bump golang.org/x/sync from 0.16.0 to 0.17.0 a91ca95a7 bump golang to version 1.24.7 to align with moby/moby version beb81a73f pkg/compose: remove aliases for container-state consts f21720787 pkg/compose: use state consts from moby API 02ffe2ac6 prefer application container vs one-off running `exec` without index f48131fb6 build(deps): bump github.com/spf13/pflag from 1.0.9 to 1.0.10 4dd369bdc fix sigint/sigterm support in logs --follow ad73766bf build(deps): bump github.com/docker/buildx from 0.28.0-rc2 to 0.28.0 3c1f5a181 go.mod: bump github.com/docker/docker, docker/cli v28.4.0 42d1e4c33 build(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 6ca8663bd build(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.9 b33ecf65e go.mod: bump buildx v0.28.0-rc2, buildkit v0.24.0-rc2 04b8ac5fe Unquote volume names in creation events d09948da4 build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1 f1efbb832 use enum-consts for State and Health 1d52012b8 go.mod: bump buildkit v0.24.0-rc1, buildx v0.28.0-rc1 1d69f4a68 pkg/compose: composeService.Up: rewrite without go-multierror 6078b4d99 Fix: use image created time when last tag time is not present Signed-off-by: Kian Eliasi <[email protected]> 73e593e69 Fix: incorrect time when last tag time is not set 51499f645 pkg/compose: pull: use native multi-errors 5165b0f81 internal/tracing: replace go-multierror.Group with sync.WaitGroup 93dd1a455 internal/sync: replace go-multierror.Group with golang.org/x/sync/errgroup ba3f5664c cmd/formatter: remove unused SetMultiErrorFormat c420bc44c check the assume yes publish flag command before the presence of bind mounts 60681a824 Add e2e test to verify `docker compose down` works even when env file is missing 19ad737ee Fix runtime ops with missing env file d3a260e53 add completions for the --progress flag e75329dce build(deps): bump go.uber.org/mock from 0.5.2 to 0.6.0 1dc0be2c3 go.mod: github.com/docker/buildx v0.27.0 3bac9ffd0 Refactor to use maps.Copy f266715dd add --provenance and --sbom flag to generated bake command line, also add attestation per-service configuration to generated bake target c2cb0aef6 only monitor attached services on up command fbc62d111 bump golang to 1.23.12 0d40064ce build(deps): bump golang.org/x/sys from 0.34.0 to 0.35.0 91a6eafa1 build(deps): bump github.com/docker/go-connections from 0.5.0 to 0.6.0 f36ee00f7 Add go as a prerequesite in build instructions 29ede3ba7 build(deps): bump github.com/containerd/containerd/v2 bf6d7bf47 define pull and no_cache from either service or flags values when building with bake fc66da06d pkg/compose: simplify getting auth-config key 909211dd6 use cli-plugins/metadata package 0dc9852c6 build(deps): bump github.com/docker/docker a47870223 build(deps): bump github.com/docker/cli 2c12ad19d use log API for containers we didn't attached to 038ea8441 apply BUILDKIT_PROGRESS value when building with bake 9e98e6101 add missing _MODEL suffix to model variable pass to dependent services of a model 52f04229c fixed lint error 28895d032 fix lint error a926f7d71 Elimneted magic string fe046915e buildkit require os.Stdout to access the raw terminal adbd61e5d fixed lint error e37ac0432 deleted useless comment cab2c2a44 Refactoring of redundant condition checks 1946de598 improved lint error 8e29a138a improved test 3c8da0afe Add test of json.go 1b12c867c add Streams Comment 1a4fc55fd bump compose-go to v2.8.1 efc939dce add info about models usage to OpenTelemetry spans d6e9f79ba Integration of SetAttributes calls b4c44a431 Eliminate magic number in init functions fb5a8644c Efficiency of ansiColorCode function 95660c5e5 bump buildx to v0.26.1 f6ddd6ae8 use output registry when push true and load to docker store if not 4ae706695 build(deps): bump google.golang.org/grpc from 1.73.0 to 1.74.2 fd954f266 show build progress during watch rebuild d62e21025 forward git command error to user 6a2d16bd1 bump compose-go to version v2.8.0 4d47da6dc do not pass user id on Windows system as engine is not able to handel it 8f91793fb introduce build.provenance and sbom support 1d2223fb2 pkg/compose: use local copy of pkg/system.IsAbs d4f600071 remove import aliases for containerd/errdefs c50d16cd7 pkg/compose: remove uses of moby/errdefs 3875e13fa simpler stop UI c89f30170 force plain displaymode if stdout isn't a terminal 41a9b9188 warn user COMPOSE_BAKE=false is deprecated 5fc2b2a71 fix yaml indentation b1cd40c31 swarm 362ab0733 build(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.7 f35d2cfb3 monitor must watch events even when context is cancelled 17ba6c718 abstract model-cli commands execution with a model (pseudo) API 1c37f1abb use logs API with Since to collect the very first logs after restart 485b6200e (refactoring) introduce monitor to manage containers events and application termination 8c17a3560 don't run navigation menu if stdin isn't a terminal 6b9667401 fix the helm bridge e2e tests after the latest update of the templates 9a1e589ce Fix report image name in bake result 5e147e852 add default compose labels to images built from bake 29308cb97 keep containers attached on stop to capture termination logs 0b0242d0a add dry-run support to bake build 5a704004d Add a space character to separate the timestamp from the log message cb9591001 chore: print model attribute instead of model name used in compose file f42226e35 feat: add --models flag to config command 0cc3c7a55 bump dependencies f7ee9c8a0 feat(os): add FreeBSD support 35efa97b7 feat: add since & until flags to events command 9e17a091b build(deps): bump github.com/docker/docker 4bbc6c609 add USER_AGENT variable to cmd when shellouting 69f1430a4 resolve Dockerfile symlink but file name 7cf7c6414 build resolves enabled service after project has been loaded 0e0ed91a3 fix: lint errors 66524e772 feat: add --networks flag to config command c626befee fix the way we're checking if the provider metadata are empty or not 60ee6adcd a single place for shell-out command setup 8faf1eb80 build(deps): bump github.com/docker/cli 3b0601b67 build(deps): bump github.com/moby/buildkit from 0.23.1 to 0.23.2 f42374bb1 add a Done event to model progress display b046a5ef7 chore: fix some minor issues in the comments 1570c6c07 bump go-viper/mapstructure to version v2.3.0 Fix GHSA-fv92-fjc5-jj9h 674e13fb6 bump golang to v1.23.10 Fix Vulnerability Report: GO-2025-3751 6fa173124 (reactoring) avoid a global variable by introducing logConsumer decorator 2c69fc3d4 pkg/compose: remove redundant uses of strslice.StrSlice 317ebcd3b implement model_variable 5cf1f0e2a bump compose-go to version v2.7.1 6198ed5bd fix linting errors 00ccddbde add volumes command test cases 63b441401 add volumes docs/reference/ 3a7982fe4 add service filter to volumes command 5430caa17 add volumes command ee1b1e0a9 run docker model configure 26e46d7cc e2e tests in CI a9e76943f introduce support for models b6a0df8d3 e2e compose run --env 5a063b751 fix provider concurrent environment map accesses ae49bba9b build(deps): bump github.com/docker/docker 51acc5845 mount /var/run/docker.sock for --use-api-socket 7c999d7f9 improve publish bind mount warning message ad750d614 remove publish limitation on bind mount list all bind mounts and ask user validation before publishing fe382df50 build(deps): bump github.com/docker/cli 6501d59ef pass project.environment to bake 33a782572 fix: typos 65803ea12 remove error message from exec outpout by default Add the error as a log for verbose mode f61337937 make sure the post_start hooks fails before we were assuming the container will be close before the post_start will be executed 3553aa26a add a default statut messsage to exec error to avoid empty line display 257ea7b75 Swap to Reader in bake to avoid hangs on output d219aa66f don't fail down cmd if services with pre_stop hook already stopped/removed c9ebfad78 exclude provider services from the list of dependencies that Compose should wait for 8e57362a0 use errdefs.IsNotImplemented to check if the logging is not implemented 29630f184 check progress default value instead of empty string to use BUILDKIT_PROGRESS env variable value 6514c680a only expose API socket to service asking for it 3394bf031 propagate target docker host set by --host to Bake 832a08f57 build(deps): bump github.com/moby/buildkit from 0.23.0 to 0.23.1 aadce87b1 inject secrets/config just before container is started b3207c455 setting buildOptions.Services triggers image to be always rebuilt 769b7391b don't create from run command during dependencies creation process 149b882eb don't create from run command during dependencies creation process c97e40e2b pkg/compose: remove uses of ExecOptions.Detach 22e23bd4d networkMode 2dde5faeb add support for cache_to with bake f7825a56b bump buildx to v0.25 4cf075ea0 bump compose-go to v2.6.5 4f491ffa9 fix panic using w shortcut on project without watch support ea1c26d22 restore ContainerName in images --json 9a5fa05ad add (temporary) support for use_api_socket 276c22945 move `run` logic inside backend eef448dc6 build(deps): bump github.com/containerd/containerd/v2 343117233 build(deps): bump google.golang.org/grpc from 1.72.2 to 1.73.0 f599a8cdd add support for extra_hosts building with bake 63b06f556 fix panic on failure starting plugin server 1d34661e9 fix support for additional_contexts with service sub-dependencies 0f9e6ab83 Fix the generated manifest for compose artifacts so that the empty config is not added as a layer. 15c9651a3 restore os.Remove(metadataFile) 4893a8b9a don't create metadatafile, just generate a random name 97530790f only look for required image in bake metadata 213c03f99 produce bake targets for all services, group for services to build ebd7b761f sanitize service name so they can be used as bake targets ea48480d8 Restore images format list format behaviour 8151b5928 bump golang.org/x/sync v0.15.0 ec49baca5 do not forgot to remove the bake metadata file few DD e2e tests failed on Windows due to permission issues 7b9ad9624 fix SIGSEGV on Enable Watch 9b67a48c3 (refactoting) Move watch logic into a dedicated Watcher type 0d0e12cc8 use Bake by default 92fafccfb add validation for required parameters of provider service when metadata are available fee8aee8f save provider metadata for Docker LSP 40f5786e6 add support of metadata subcommand for provider services This command will let Compose and external tooling know about which parameters should be passed to the Compose plugin 61e44da93 debug message to help diagnose platform mismatch 0bf7d1ea2 pull does not require env_file being resolved 80ace63df build(deps): bump google.golang.org/grpc from 1.72.1 to 1.72.2 27e90a3fd end-to-end test 3ca75bdf5 Fix the inability to restart the Compose stack after network configuration change eb3074bbd include platform and creation date listing image used by running compose application f4fc010d6 build dependent service images when required 693b9ef07 fix support for BUILDKIT_PROGRESS 046879a4a replace uses of golang.org/x/exp/(maps|slices) for stdlib 7c79b2300 pkg/bridge: fix importShadow: shadow of imported package (gocritic) ad4cbee49 bump github.com/docker/docker, docker/cli v28.2.2 60256a875 fix typo in suggestion log 45bd60c33 resolve symlinks while making dockerfile path absolute cf89fd1aa also (re)start dependent services after watch rebuilt image 23fef850b prefer use of slices.DeleteFunc 12b73bea7 remove utils.Contains to prefer slice.ContainsFunc 2e71440be refactor: use slices.Contains to simplify code d49a68ecb bridge - run transformer container as current user be83f63f2 add e2e tests for bridge convert and transformers ls commands 9a9227ce6 add new bridge commands documentation 024f8ebdc add convert subcommand to bridge command 8c622da20 add bridge command and transformations subcommands bbb2b76a1 bump cli-doc-tools to v0.10.0 and update the documentation to pass CI checks e45e58b3e bumpd buildkit v0.22.0 and buildx v0.24.0 f52af4c86 bump compose-go to v2.6.4 a54814ff3 e2e test a2d7548ca fix up --build with additional_context dependency 8a2cb90a3 example provider implementation cc50ada72 report error (re)creating container 5c74f0799 build(deps): bump github.com/containerd/containerd/v2 7e198ee6a remove provenance build flag for now 0566431c6 only use attestation when building image outside the development inner loop when building a image, by default attestation are generated and modify the image ID which trigger a container recreation on up, run command even if there isn't any changes on the image content itself 4f6cc2a33 run ContainerStart sequentially 2352a4a01 introduce config --lock-image-digests 1f076a378 bump compose-go to v2.6.3 009a23951 remove convert alias from config command 305957428 build(deps): bump google.golang.org/grpc from 1.72.0 to 1.72.1 1229a6938 build(deps): bump github.com/containerd/containerd/v2 f2a88e02a ensure build dependencies are enabled 7f9101845 report cancelled pull after another one failed 944e5e67a do not throw an error on build with provider services 23fc76a54 Fix quiet option when using COMPOSE_BAKE=1 053d22582 append .exe to provider name doing executable lookup on windows 93b597cce remove Docker EULA licensing which isn't relevant since Docker switched to a subscription model 4dcaf94c3 add support of 'debug' messages in the communication between Compose and provider binaries 07e7619f4 set provider environment ed81185c5 fix provider info message 22f8a7009 provider.options can be an array 91a0aa026 skip push step for provider services 7cea455c4 simplification 559a51e59 build(deps): bump golang.org/x/sys from 0.32.0 to 0.33.0 480a556bf build(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 626336119 build(deps): bump github.com/moby/buildkit from 0.21.0 to 0.21.1 9ee03c3fe bump compose-go to v2.6.2 4bf18d232 docs: regenerate f0f47a8aa e2e: add tests d6e3fa6d7 Fix config --variables not honoring the --format flag 16e83f002 introduce build --check 2dbef234d document behavior on missing extension 20f0ffec0 seach for provider binary in PATH cee6a3c66 document extensibility using service.provider fc8c56b40 select services implicitly declared by a service:xx build dependency 9c998a934 fix collect image digests for service images built by bake 0403f0d76 e2e test for start_interval 91d04a5ca build(deps): bump go.uber.org/mock from 0.5.1 to 0.5.2 d2274ebe6 display proper event message for provider services on up and down 6e3565218 fix support for remote absolute path 5bb46035c Set --progress flag default value from env if provided f8dae06df Add support for COMPOSE_PROGRESS env variable 955e4ed94 introduce networks.interface_name 60385e606 bump compose-go to v2.6.1 fixing parsing of npipe as volume type f5491328b remove support of Synchronize File Shares integration with Docker Desktop f46689a75 build(deps): bump github.com/containerd/containerd/v2 8fd0c297f build(deps): bump google.golang.org/grpc from 1.71.1 to 1.72.0 f3bbfdae5 build(deps): bump github.com/docker/docker 322c531a8 build(deps): bump github.com/docker/cli bf6b44726 fix: concurrent map writes when pulling a96c305b2 build: write --print output to stdout 2d7cd2a99 go.mod: bump github.com/docker/cli v28.1.0 cbb616ca0 go.mod: bump github.com/docker/docker v28.1.0 640c7deae downgrade go-difflib and go-spew to tagged releases 75b48cfc8 go.mod: bump github.com/docker/buildx v0.23.0 047899c3e go.mod: bump github.com/moby/buildkit v0.21.0 f91b41875 go.mod: bump github.com/docker/docker-credential-helpers v0.9.3 42cccb1fe go.mod: bump golang.org/x/net v0.39.0 674af0d66 go.mod: bump golang.org/x/crypto v0.37.0 877d23233 go.mod: bump golang.org/x/term v0.31.0 4bba13233 go.mod: bump golang.org/x/text v0.24.0 a786e70b0 go.mod: bump golang.org/x/time v0.11.0 13cd780f3 migrate to use github.com/moby/go-archive 8e2f799cd chore: make function comment match function name 2a84dfecf build(deps): bump golang.org/x/crypto from 0.32.0 to 0.35.0 f6913b086 build(deps): bump go.uber.org/mock from 0.5.0 to 0.5.1 d629fffa9 build(deps): bump google.golang.org/grpc from 1.71.0 to 1.71.1 7471e16d8 build(deps): bump github.com/moby/buildkit from 0.20.1 to 0.20.2 51907d9f7 fix zizmor security alerts on GHA workflows a3f88a0a1 test to cover preference for bind API c83f1285a use bind API for bind mounts 29e642e23 ci(bin-image): free disk space 0c37c1096 mount API is not strictly equivalent to bind 43cc2be8c build(deps): bump github.com/compose-spec/compose-go/v2 01e83defc introduce volume.type=image 846161d44 Fix linting issue with resp.Body.Close() 0bcc629fb refactor: improve Desktop client structure 482b62228 pkg/compose: implement Export using atomicwriter ee3314302 capture git fetch output when debug output is enabled cb0b5f6e2 build(deps): bump golang.org/x/sync from 0.12.0 to 0.13.0 138485353 build(deps): bump golang.org/x/sys from 0.31.0 to 0.32.0 096b1e32d plugin provider support: check docker model runner status bf71138df cleanup runPluging function a1f673dcf Update secret detector to fix vulnerability GHSA-mh63-6h87-95cp 02c747a7d bump compose-go to custom version of v2.5.0 should be replace by v2.5.1 it will be released 88f4f265d communicate with plugin using json events e67348222 DRAFT external services plugin support b54338070 feat(run): Add --quiet and --quiet-build options for the run command 2e75185a0 bump golang to 1.23.8 7bedb5a02 bump golangci-lint to version v2.0.2 and apply migration script f9cd4d0b1 bump docker,cli,buildx 0badcf3c8 include implicit build dependencies in build command ec49db98d fix: replace docker-compose.yml with compose.yaml e5a353b34 fix: replace docker-compose.yml with compose.yaml 43e456145 fix scale completion 75368c785 introduce `build --print` to dump equivalent bakefile 6e814eac3 fix(secrets): Reverted secrets file mode 440 -> 444 a0d1c3f94 introduce config --no-env-resolution 0c5bd16da bake parses "${}" in DockerfileInline as a variable b0badf1eb Set watch option --prune=true as default 342a2a9e7 Fix support for depends_on.restart in up and restart commands 7814e5798 build(deps): bump github.com/containerd/containerd/v2 42b2e1109 build(deps): bump github.com/docker/buildx from 0.21.2 to 0.21.3 6a8c0988c run only loads required service env_file and ignores others 9129abe51 Fix edge-case bug path prefix check for watch & bind mounts f38f3f754 PWD ea07ba8e2 fix support for secret set by env inside included file 432ae23b0 Test commandName subcommand order b6f313b8a bump compose-go to version v2.4.9 13618756d make publish a regular command of Compose 6c1e21572 lint: address gofumpt issues 33e863ac6 fix linting issue f70209cf1 review: move Summary/Replica collection from cmd/ to pkg/ 62e832eb5 compose top: reduce tabwriter padding 80e8fda14 compose top: ensure CMD is right-most column 375a27978 top: expose container labels a766e1669 condense output of `compose top` 793c6f171 add cli.isatty attribute to spans generated by compose 8e3e1f7f8 build(deps): bump tags.cncf.io/container-device-interface 83cafe283 Add support to pass env-from-file to docker compose run 55b5f233c use Defang secret-detector to identify potential secret leaks before publishing OCI artifacts c3a0c3568 implement extends.file replace without yqlib 8615e9a7c deprecate --y, prefer --yes b23728941 only load env_file after services have been selected 1a7343bc8 build(deps): bump github.com/moby/buildkit from 0.20.0 to 0.20.1 41e609404 add warning message when a remote configuration include an another remote config 66a47169d Publish compose file with required siblings used by `extends` 4c72d3a0e build(deps): bump golang.org/x/sys from 0.30.0 to 0.31.0 59f39b999 build(deps): bump google.golang.org/grpc from 1.70.0 to 1.71.0 7ab65ba12 build(deps): bump golang.org/x/sync from 0.11.0 to 0.12.0 d9f05d72d improve message suggesting using bake 7b88c5b0e display interpolation variables and their values when running a remote stack eaf980094 build(deps): bump github.com/opencontainers/image-spec Signed-off-by: Bruce Ashfield <[email protected]>

ndeloof requested a review from a team as a code owner October 15, 2025 09:14

ndeloof requested a review from glours October 15, 2025 09:14

Set secret/config uid:gid to match container's USER

9dbe094

Signed-off-by: Nicolas De Loof <[email protected]>

ndeloof force-pushed the secret_env_uid branch 6 times, most recently from 320ad9f to 3dee52f Compare October 15, 2025 13:11

mutualize code from injectSecrets / injectConfigs

581674e

Signed-off-by: Nicolas De Loof <[email protected]>

ndeloof force-pushed the secret_env_uid branch from 3dee52f to 581674e Compare October 15, 2025 13:42

glours approved these changes Oct 16, 2025

View reviewed changes

ndeloof merged commit 2681ed1 into docker:main Oct 16, 2025
25 checks passed

BrewTestBot mentioned this pull request Oct 17, 2025

docker-compose 2.40.1 Homebrew/homebrew-core#250039

Merged

rancherbot mentioned this pull request Oct 18, 2025

rddepman: bump dockerCompose from 2.40.0 to 2.40.1 rancher-sandbox/rancher-desktop#9333

Merged

KhalidAlansary mentioned this pull request Oct 18, 2025

[BUG] crashes while parsing when using docker compose secrets and USER in Dockerfile #13296

Closed

ndeloof added a commit to ndeloof/compose that referenced this pull request Oct 20, 2025

Compose can't create a tar with adequate uid:gid ownership

50a83ca

as we can't get container UID/GID as int by ContainerInspect revert docker#13288 Signed-off-by: Nicolas De Loof <[email protected]>

ndeloof added a commit to ndeloof/compose that referenced this pull request Oct 20, 2025

Compose can't create a tar with adequate uid:gid ownership

f68e33b

as we can't get container UID/GID as int by ContainerInspect revert docker#13288 Signed-off-by: Nicolas De Loof <[email protected]>

ndeloof added a commit to ndeloof/compose that referenced this pull request Oct 20, 2025

Compose can't create a tar with adequate uid:gid ownership

07f5e2d

as we can't get container UID/GID as int by ContainerInspect revert docker#13288 Signed-off-by: Nicolas De Loof <[email protected]>

ndeloof added a commit that referenced this pull request Oct 20, 2025

Compose can't create a tar with adequate uid:gid ownership

585c4db

as we can't get container UID/GID as int by ContainerInspect revert #13288 Signed-off-by: Nicolas De Loof <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Set secret/config uid:gid to match container's USER #13288

Set secret/config uid:gid to match container's USER #13288

Uh oh!

ndeloof commented Oct 15, 2025

Uh oh!

codecov bot commented Oct 15, 2025

Uh oh!

glours left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Set secret/config uid:gid to match container's USER #13288

Set secret/config uid:gid to match container's USER #13288

Uh oh!

Conversation

ndeloof commented Oct 15, 2025

Uh oh!

codecov bot commented Oct 15, 2025

Codecov Report

Uh oh!

glours left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants