Repository navigation
[BUG] crashes while parsing when using docker compose secrets and USER in Dockerfile #13296
Description
Description
Crash output:
strconv.Atoi: parsing "postgres": invalid syntax
The bug was introduced in v2.40.1 It didn't occur in v2.40.0
I think this was introduced in #13288 by @ndeloof .
The bug occurs when using docker compose secrets with a Dockerfile that contains the USER instruction.
Steps To Reproduce
- Create a file named
Dockerfilewith the following contents (you can leave the comment as it is):
FROM docker.io/postgres:18
USER root
# RUN apt install some stuff
USER postgres- Create a
compose.yamlfile with the following contents:
services:
db:
build:
context: .
environment:
POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
secrets:
- postgres_password
secrets:
postgres_password:
environment: POSTGRES_PASSWORD- Create a .env file with the following contents:
POSTGRES_PASSWORD=secret
- Run
docker compose up
You should see the error strconv.Atoi: parsing "postgres": invalid syntax
Compose Version
Docker Compose version 2.40.1
Docker Environment
Client:
Version: 28.5.1
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: 0.29.1
Path: /usr/lib/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: 2.40.1
Path: /usr/lib/docker/cli-plugins/docker-compose
Server:
Containers: 2
Running: 0
Paused: 0
Stopped: 2
Images: 14
Server Version: 28.5.1
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: true
Native Overlay Diff: false
userxattr: false
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
/etc/cdi
/var/run/cdi
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 75cb2b7193e4e490e9fbdc236c0e811ccaba3376.m
runc version:
init version: de40ad0
Security Options:
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.17.3-arch2-1
Operating System: Arch Linux
OSType: linux
Architecture: x86_64
CPUs: 16
Total Memory: 15.39GiB
Name: Archie
ID: 4f8ab52e-4360-4ccd-a597-046a27df2299
Docker Root Dir: /var/lib/docker
Debug Mode: false
Experimental: false
Insecure Registries:
::1/128
127.0.0.0/8
Live Restore Enabled: false
Anything else?
No response
Activity
ndeloof commentedon Oct 20, 2025
diagnostic : containerInspect returns
Config.User=root, not actual UID:GID 🥲I'll check if we have an alternative, otherwise will have to revert #13288
thaJeztah commentedon Oct 20, 2025
Yes this is probably similar to what I had to fix in
copy- it's a tricky one though, because the lookup has to happen within the container filesystem, and depending on how users are defined, even within the container's namespace (nss lookups)