From 5c2f28a23227099c5ca89ca296d44e44d5b23990 Mon Sep 17 00:00:00 2001 From: Md Yunus Date: Sun, 5 Apr 2026 01:23:35 +0530 Subject: [PATCH 1/3] fix: ensure deterministic variable interpolation using sorted map keys This fixes the non-deterministic behavior when multiple required variables (e.g., ${TIMEZONE:?}, ${TRAEFIK_ACME_PATH:?}) are missing. Go's map iteration order is randomized, causing different error messages to be reported on each run. Changes: - Add replace directive to use fixed compose-go fork - The compose-go fix adds sort.Strings(keys) before map iteration to ensure consistent error reporting Fixes: https://github.com/docker/compose/issues/13712 Signed-off-by: Md Yunus --- go.mod | 2 ++ go.sum | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/go.mod b/go.mod index bee27a683e..a4cd42609b 100644 --- a/go.mod +++ b/go.mod @@ -1,5 +1,7 @@ module github.com/docker/compose/v5 +replace github.com/compose-spec/compose-go/v2 => github.com/yunus25jmi1/compose-go/v2 v2.0.0-20260404194456-e694d656b965 + go 1.25.5 require ( diff --git a/go.sum b/go.sum index d0a5e506df..6de64a8125 100644 --- a/go.sum +++ b/go.sum @@ -36,8 +36,6 @@ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE= github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4= -github.com/compose-spec/compose-go/v2 v2.10.1 h1:mFbXobojGRFIVi1UknrvaDAZ+PkJfyjqkA1yseh+vAU= -github.com/compose-spec/compose-go/v2 v2.10.1/go.mod h1:Ohac1SzhO/4fXXrzWIztIVB6ckmKBv1Nt5Z5mGVESUg= github.com/containerd/cgroups/v3 v3.1.3 h1:eUNflyMddm18+yrDmZPn3jI7C5hJ9ahABE5q6dyLYXQ= github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw= github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc= @@ -374,6 +372,8 @@ github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtX github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= +github.com/yunus25jmi1/compose-go/v2 v2.0.0-20260404194456-e694d656b965 h1:KxVS4bEeImUm3vsCTiptwg12iJMEybtdYoP6KLQTLRU= +github.com/yunus25jmi1/compose-go/v2 v2.0.0-20260404194456-e694d656b965/go.mod h1:ZU6zlcweCZKyiB7BVfCizQT9XmkEIMFE+PRZydVcsZg= go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0= go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= From 2ebd515baa0d2716eb6627283c04a420fb8e73e4 Mon Sep 17 00:00:00 2001 From: Md Yunus Date: Sun, 5 Apr 2026 01:40:38 +0530 Subject: [PATCH 2/3] chore: add TODO comment for replace directive removal plan TODO: Remove replace once compose-go#860 is merged See: https://github.com/compose-spec/compose-go/pull/860 Signed-off-by: Md Yunus --- go.mod | 2 ++ 1 file changed, 2 insertions(+) diff --git a/go.mod b/go.mod index a4cd42609b..e6ddcaa741 100644 --- a/go.mod +++ b/go.mod @@ -1,5 +1,7 @@ module github.com/docker/compose/v5 +// TODO: Remove replace once compose-go#860 is merged. See: https://github.com/compose-spec/compose-go/pull/860 + replace github.com/compose-spec/compose-go/v2 => github.com/yunus25jmi1/compose-go/v2 v2.0.0-20260404194456-e694d656b965 go 1.25.5 From d84c59f57f2f7f7043a6d06e1f1aa430e9a76894 Mon Sep 17 00:00:00 2001 From: Md Yunus Date: Sat, 11 Apr 2026 12:38:29 +0530 Subject: [PATCH 3/3] chore: use official compose-go v2.10.2 instead of personal fork Removes the replace directive pointing to a personal fork (supply-chain risk). Uses official compose-go v2.10.2 from upstream. Note: The deterministic interpolation fix from compose-go#860 is not yet merged upstream. Once merged, we can update to the version with the fix. Signed-off-by: Md Yunus --- go.mod | 4 ---- go.sum | 4 ++-- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index e75fa59f45..7106789b46 100644 --- a/go.mod +++ b/go.mod @@ -1,9 +1,5 @@ module github.com/docker/compose/v5 -// TODO: Remove replace once compose-go#860 is merged. See: https://github.com/compose-spec/compose-go/pull/860 - -replace github.com/compose-spec/compose-go/v2 => github.com/yunus25jmi1/compose-go/v2 v2.0.0-20260404194456-e694d656b965 - go 1.25.5 require ( diff --git a/go.sum b/go.sum index c70d7bbbd2..cada823718 100644 --- a/go.sum +++ b/go.sum @@ -36,6 +36,8 @@ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE= github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4= +github.com/compose-spec/compose-go/v2 v2.10.2 h1:USa1NUbDcl/cjb8T9iwnuFsnO79H+2ho2L5SjFKz3uI= +github.com/compose-spec/compose-go/v2 v2.10.2/go.mod h1:ZU6zlcweCZKyiB7BVfCizQT9XmkEIMFE+PRZydVcsZg= github.com/containerd/cgroups/v3 v3.1.3 h1:eUNflyMddm18+yrDmZPn3jI7C5hJ9ahABE5q6dyLYXQ= github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw= github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc= @@ -372,8 +374,6 @@ github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtX github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= -github.com/yunus25jmi1/compose-go/v2 v2.0.0-20260404194456-e694d656b965 h1:KxVS4bEeImUm3vsCTiptwg12iJMEybtdYoP6KLQTLRU= -github.com/yunus25jmi1/compose-go/v2 v2.0.0-20260404194456-e694d656b965/go.mod h1:ZU6zlcweCZKyiB7BVfCizQT9XmkEIMFE+PRZydVcsZg= go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0= go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=