Repository navigation
[BUG] Build secret files not mounted in /run/secrets when using docker compose build #13019
Description
Description
If I set up a Dockerfile for build secrets, docker build --secret ... works just fine per the official docs.
If I set up a docker compose project per the official docs (this one too) the secrets fail to get built into the image!
Note: this is highly related to other issues such as #9822, though this is a formal bug report according to how build secrets are expected to work with docker compose.
Steps To Reproduce
- Create a simple local test file:
echo "SECRET TEST" > test-secret.txt - Create a Dockerfile with this content
#Dockerfile
FROM debian:stable-slim
RUN --mount=type=secret,id=test-secret ls -la /run/secrets/; cp /run/secrets/test-secret /tmp
CMD ["cat", "/tmp/test-secret"]- Create a docker-compose file with this content:
#docker-compose.yaml
secrets:
test:
file: ./test-secret.txt
services:
secret-build-test:
build:
context: .
dockerfile: Dockerfile
secrets:
- test- Verify that a typical docker build works as expected...
docker build --progress=plain --secret id=test-secret,src=$(pwd)/test-secret.txt . -f ./Dockerfile --no-cacheshould output something like the following:
#0 building with "default" instance using docker driver
#1 [internal] load build definition from Dockerfile
#1 transferring dockerfile: 189B done
#1 DONE 0.0s
#2 [internal] load metadata for docker.io/library/debian:stable-slim
#2 DONE 0.5s
#3 [internal] load .dockerignore
#3 transferring context: 2B done
#3 DONE 0.0s
#4 [stage-0 1/2] FROM docker.io/library/debian:stable-slim@sha256:7e0b7fe7c6d695d615eabaea8d19adf592a6a9ff3dbd5206d3e31139b9afdfa7
#4 CACHED
#5 [stage-0 2/2] RUN --mount=type=secret,id=test-secret ls -la /run/secrets/; cp /run/secrets/test-secret /tmp
#5 0.162 total 12
#5 0.162 drwxr-xr-x 2 root root 4096 Jul 4 14:51 .
#5 0.162 drwxr-xr-x 1 root root 4096 Jul 4 14:51 ..
#5 0.162 -r-------- 1 root root 12 Jul 4 14:51 test-secret
#5 DONE 0.2s
#6 exporting to image
#6 exporting layers 0.0s done
#6 writing image sha256:0130a338af5dbe1426ef85ce3b1f67a2e793797443d88149aee596ea3dc70833 done
#6 DONE 0.0s
- Demonstrate that a direct docker compose build fails!
docker compose build secret-build-test --progress=plain --no-cacheThis outputs the following for me
--progress is a global compose flag, better use `docker compose --progress xx build ...
#1 [internal] load local bake definitions
#1 reading from stdin 570B done
#1 DONE 0.0s
#2 [internal] load build definition from Dockerfile
#2 transferring dockerfile: 189B done
#2 DONE 0.0s
#3 [internal] load metadata for docker.io/library/debian:stable-slim
#3 DONE 0.5s
#4 [internal] load .dockerignore
#4 transferring context: 2B done
#4 DONE 0.0s
#5 [stage-0 1/2] FROM docker.io/library/debian:stable-slim@sha256:7e0b7fe7c6d695d615eabaea8d19adf592a6a9ff3dbd5206d3e31139b9afdfa7
#5 CACHED
#6 [stage-0 2/2] RUN --mount=type=secret,id=test-secret ls -la /run/secrets/; cp /run/secrets/test-secret /tmp
#6 0.138 ls: cannot access '/run/secrets/': No such file or directory
#6 0.139 cp: cannot stat '/run/secrets/test-secret': No such file or directory
#6 ERROR: process "/bin/sh -c ls -la /run/secrets/; cp /run/secrets/test-secret /tmp" did not complete successfully: exit code: 1
------
> [stage-0 2/2] RUN --mount=type=secret,id=test-secret ls -la /run/secrets/; cp /run/secrets/test-secret /tmp:
0.138 ls: cannot access '/run/secrets/': No such file or directory
0.139 cp: cannot stat '/run/secrets/test-secret': No such file or directory
------
Dockerfile:2
--------------------
1 | FROM debian:stable-slim
2 | >>> RUN --mount=type=secret,id=test-secret ls -la /run/secrets/; cp /run/secrets/test-secret /tmp
3 |
4 | CMD ["cat", "/tmp/test-secret"]
--------------------
failed to solve: process "/bin/sh -c ls -la /run/secrets/; cp /run/secrets/test-secret /tmp" did not complete successfully: exit code: 1
Compose Version
Docker Compose version v2.37.1-desktop.1
Docker Environment
Client:
Version: 28.2.2
Context: default
Debug Mode: false
Plugins:
ai: Docker AI Agent - Ask Gordon (Docker Inc.)
Version: v1.4.0
Path: /usr/local/lib/docker/cli-plugins/docker-ai
buildx: Docker Buildx (Docker Inc.)
Version: v0.24.0-desktop.2
Path: /usr/local/lib/docker/cli-plugins/docker-buildx
cloud: Docker Cloud (Docker Inc.)
Version: v0.3.9
Path: /usr/local/lib/docker/cli-plugins/docker-cloud
compose: Docker Compose (Docker Inc.)
Version: v2.37.1-desktop.1
Path: /usr/local/lib/docker/cli-plugins/docker-compose
debug: Get a shell into any image or container (Docker Inc.)
Version: 0.0.41
Path: /usr/local/lib/docker/cli-plugins/docker-debug
desktop: Docker Desktop commands (Docker Inc.)
Version: v0.1.9
Path: /usr/local/lib/docker/cli-plugins/docker-desktop
extension: Manages Docker extensions (Docker Inc.)
Version: v0.2.29
Path: /usr/local/lib/docker/cli-plugins/docker-extension
init: Creates Docker-related starter files for your project (Docker Inc.)
Version: v1.4.0
Path: /usr/local/lib/docker/cli-plugins/docker-init
mcp: Docker MCP Plugin (Docker Inc.)
Version: dev
Path: /usr/local/lib/docker/cli-plugins/docker-mcp
model: Docker Model Runner (Docker Inc.)
Version: v0.1.24
Path: /usr/local/lib/docker/cli-plugins/docker-model
sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
Version: 0.6.0
Path: /usr/local/lib/docker/cli-plugins/docker-sbom
scout: Docker Scout (Docker Inc.)
Version: v1.18.1
Path: /home/kevin/.docker/cli-plugins/docker-scout
WARNING: Plugin "/usr/local/lib/docker/cli-plugins/docker-dev" is not valid: failed to fetch metadata: fork/exec /usr/local/lib/docker/cli-plugins/docker-dev: no such file or directory
WARNING: Plugin "/usr/local/lib/docker/cli-plugins/docker-feedback" is not valid: failed to fetch metadata: fork/exec /usr/local/lib/docker/cli-plugins/docker-feedback: no such file or directory
WARNING: Plugin "/usr/local/lib/docker/cli-plugins/docker-scan" is not valid: failed to fetch metadata: fork/exec /usr/local/lib/docker/cli-plugins/docker-scan: no such file or directory
Server:
Containers: 1
Running: 0
Paused: 0
Stopped: 1
Images: 6
Server Version: 28.2.2
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
/etc/cdi
/var/run/cdi
Discovered Devices:
cdi: docker.com/gpu=webgpu
Swarm: inactive
Runtimes: nvidia runc io.containerd.runc.v2
Default Runtime: runc
Init Binary: docker-init
containerd version: 05044ec0a9a75232cad458027ca83437aae3f4da
runc version: v1.2.5-0-g59923ef
init version: de40ad0
Security Options:
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.6.87.2-microsoft-standard-WSL2
Operating System: Docker Desktop
OSType: linux
Architecture: x86_64
CPUs: 20
Total Memory: 31.18GiB
Name: docker-desktop
ID: adac6913-bc44-4345-b8d0-ba432c46a5ce
Docker Root Dir: /var/lib/docker
Debug Mode: false
HTTP Proxy: http.docker.internal:3128
HTTPS Proxy: http.docker.internal:3128
No Proxy: hubproxy.docker.internal
Labels:
com.docker.desktop.address=unix:///var/run/docker-cli.sock
Experimental: false
Insecure Registries:
hubproxy.docker.internal:5555
::1/128
127.0.0.0/8
Live Restore Enabled: false
WARNING: DOCKER_INSECURE_NO_IPTABLES_RAW is set
Anything else?
No response
Activity
kmfarley11 commentedon Jul 4, 2025
Just kidding, sorry about the confusion. This was user error on my part.
Forgot that the docker compose listed secret needs to match the id listed in the Dockerfile 🙃
It works if i adjust the
testlabels/references in docker-compose.yaml to betest-secretas the Dockerfile expectskmfarley11 commentedon Jul 4, 2025
Just kidding again, it seems that my core issue is actually that profiles seem to be interfering with build secrets somehow in a way I wouldn't expect. I'll create a new issue to be truly reproducible for my current use-case.